Vitalik Buterin is calling for a shift toward “local-first” artificial intelligence, arguing that modern AI systems built on cloud infrastructure create serious privacy and security exposure. In his view, users are handing sensitive data, operational control, and personal context to external servers at a time when AI tools are becoming more autonomous.
In a recent blog post, Buterin said AI is moving past basic chat interfaces. New systems can act as agents that “think for a long time and use hundreds of tools” to complete tasks. That change matters. It increases the amount of sensitive information these systems can touch and raises the odds of unauthorized actions. Buterin said he has already stopped using cloud-based AI and described his own setup as “self-sovereign, local, private, and secure.”
Cloud dependence and agent behavior widen the attack surface
Buterin argued that many AI products rely heavily on cloud services, which means users are effectively feeding “our entire personal lives to cloud AI.” The concern is not limited to storage. Some AI agents may alter critical settings or open new communication channels without asking the user first.
He also warned that large language models can fail or be manipulated. Giving them broader control makes safeguards more important, not less. Research cited in his post found that about 15% of agent “skills” included malicious instructions, while some tools were shown to send data to outside servers without user awareness.
Another issue is hidden backdoors. According to Buterin, certain models may behave normally until specific conditions trigger actions aligned with a developer’s interests. He also questioned how much transparency so-called open models really offer, saying many are only “open-weights,” leaving their internal structure and potential risks partly obscured.
A local stack built around on-device inference and strict isolation
To reduce those risks, Buterin proposed a setup centered on local inference, local storage, and aggressive sandboxing. The principle is simple: keep as much as possible on the device, isolate tools from one another, and treat outside input as hostile until proven otherwise.
He tested several hardware options using the Qwen3.5:35B model. His benchmark was practical rather than theoretical. Performance below 50 tokens per second felt too annoying for normal use, while around 90 tokens per second delivered a smoother experience. A laptop equipped with an NVIDIA 5090 GPU reached close to 90 tokens per second. DGX Spark came in at about 60 tokens per second, which he described as weak compared with a high-end laptop.
On the software side, his system runs on NixOS, with llama-server handling local inference, llama-swap managing models, and bubblewrap isolating processes while restricting access to files and networks. His position is cautious: AI can be useful, but it should not be fully trusted, much like the way developers treat smart contracts.
Human approval remains mandatory for messages and transactions
For actions such as sending messages or making transactions, Buterin uses a “2-of-2” confirmation model. The action proceeds only when both the AI output and the human approval are present. He said a combined “human + LLM” decision process is safer than relying on either one alone.
Even when he uses remote models, requests are first routed through a local model that strips sensitive information before anything leaves the device. For people who cannot afford this kind of hardware on their own, he suggested pooling resources with friends to buy a computer and GPU at that level and then connecting to it remotely.
More capable AI agents bring more operational risk
Buterin’s warning comes as AI agents gain traction, including projects such as OpenClaw. These systems can operate independently and use multiple tools to complete tasks. Their capabilities are expanding fast. So is their exposure.
He said malicious external content, including a hostile webpage, can lead to an “easy takeover” of the system. Some agents may also change prompts or system settings without approval, increasing the chance of unauthorized access and data leakage.