An AI agent that talks to a hosted model leaks more than its answers. The API key ties every prompt to an account, the account ties to a payment method, and the provider can join years of requests into a single profile. Prompts are personal: people ask models about health, money, and private doubts. Ethereum co-founder Vitalik Buterin recently described a working configuration that separates these layers, and it is a useful reference for anyone running an agent. A privacy setup that matters breaks the link at each of the three places it forms: payment, network path, and the text itself.
The payment layer: zkAPI
zkAPI is a project from the Ethereum Foundation and the Open Anonymity Project, live on Ethereum mainnet. A user deposits ETH or USDC into a vault contract once, then authorizes spending with zero-knowledge proofs instead of an identity. Deposits are held as commitments in a Merkle tree, so a proof can show that one valid note covers a request without pointing at which note it is. Each spend publishes a nullifier, a one-way serial number that proves a balance is not spent twice without revealing its source. The zkAPI server verifies the proof and mints a short-lived, dollar-capped API key, and the provider that runs the model sees prompts and responses but never learns who is paying. The design grew out of research published by Davide Crapis and Vitalik Buterin on Ethereum Research.
The network layer: Tor
zkAPI hides the billing link but not the network. A gateway can still correlate requests that arrive from a stable IP address. The countermeasure is to route traffic through Tor and give each conversation its own circuit, so sessions do not share an exit path, and to pad the traffic with random cover requests. Tor is not a perfect fit here. It adds latency, and a provider that colludes with a Tor guard can still work the timing. A mixnet with constant cover traffic would be stronger, at the cost of more bandwidth.
The content layer: a local rewrite model
Even with payment and routing separated, the prompts themselves can re-link sessions. Reused writing style, personal details, or the same project documents act as fingerprints that survive any payment or network separation. A local, user-supplied model rewrites prompts before they leave the machine, so the provider sees a sanitized request rather than the raw one. The whole arrangement plugs into an OpenAI-compatible daemon, so existing apps and editors keep working while the rewrite runs underneath. This trades usefulness for privacy: a standalone query is harder to link, but it loses the context a long conversation carries.
Isolation and honest limits
The whole stack sits in a sandbox such as bubblewrap, which restricts what the agent process can reach on the host, with microVM isolation under exploration. None of this makes an agent invisible. The setup protects against passive observers and casual profiling, not against a provider that actively correlates timing across requests. Anyone adopting it should weigh three costs: the latency of opening a fresh circuit for each conversation, the weaker cover-traffic model when the provider and a Tor guard cooperate, and the gas cost of zkAPI deposits and withdrawals. Cheaper gas on mainnet is the development to watch, because it would put these tools within reach of smaller agents and ordinary users.
Source: BTC-Pulse.