Ethereum co-founder Vitalik Buterin revealed in an April blog post that he has entirely moved off cloud AI services, switching to a fully local and sandboxed artificial intelligence system. The move directly responds to what he sees as severe security and privacy failures in the AI agent space, citing research showing that roughly 15% of agent skills, or plug-in tools, contain malicious instructions.
Hardware: Nvidia 5090 Pushes 90 Tokens Per Second
Buterin runs his setup on a laptop with an Nvidia 5090 GPU (24 GB VRAM). Using llama-server, he loads Alibaba's open-weights Qwen3.5:35B model, achieving 90 tokens per second—his target for comfortable daily use. He also tested the AMD Ryzen AI Max Pro (128 GB unified memory, 51 token/s) and the DGX Spark (60 token/s), calling the latter unimpressive given its cost and lower throughput compared to a good laptop GPU.
On the software side, Buterin moved from Arch Linux to NixOS, which lets users define system configurations in a single declarative file. LLaMA-server runs as a background daemon exposing a local port for any application to connect to. For instance, Claude Code can be pointed at a local llama-server instance instead of Anthropic's servers.
Security Model: Human + LLM 2-of-2 Confirmation
Sandboxing is central. Buterin uses bubblewrap to create isolated environments; processes inside those sandboxes can access only explicitly allowed files and network ports. More critically, he open-sourced a messaging daemon that wraps signal-cli and email. The daemon can read messages freely and send messages to itself without confirmation, but any outbound message to a third party requires explicit human approval. Buterin calls this the “human + LLM 2-of-2” model and says the same logic should apply to Ethereum wallets: teams building AI-connected wallet tools should cap autonomous transactions at $100 per day and require human confirmation for higher amounts or any transaction carrying calldata that could exfiltrate data.
Local Toolchain: Wikipedia Dump Meets Privacy-First Search
To reduce reliance on external search queries—which Buterin treats as a privacy leak—he stores a local Wikipedia dump of roughly 1 TB alongside technical documentation. He also published a local audio transcription daemon (stt-daemon) that works without a GPU for basic use and feeds output to the LLM for correction and summarization.
For tasks where local models fall short, Buterin outlined a privacy-preserving approach to remote inference: his ZK-API proposal with researcher Davide, the Openanonymity project, and mixnets to prevent servers from linking successive requests by IP address. In the near term, trusted execution environments can reduce data leakage, while fully homomorphic encryption for private cloud inference remains too slow to be practical.
Buterin closed by noting the post describes a starting point, not a finished product, and warned readers against copying his exact tools and assuming they are secure.