Paranoid

Paranoid mode, for everyone. Deposit once on Solana and use any AI without it knowing who you are. Based on zkAPI.

[Paranoid @paranoiddotred]

https://t.co/vyGFm3FYXG

[Paranoid @paranoiddotred]

PARANOID’s code was going to stay private. For a privacy product, keeping the details closed felt like the safer choice.

MCP changed our minds. We want you to use PARANOID right inside Claude Code and Cursor, and MCP, the standard way to plug tools into AI assistants, is how we get there. That means the code has to be public, so today we are opening our GitHub, starting with the MCP server.

We don’t plan to stop at one piece. We are building toward a future where people and their AI agents can ask anything without being known, and the best way to earn that trust is to let everyone read how it works. PARANOID is going open source.

[Paranoid @paranoiddotred]

We have been quietly building something on PARANOID for a while. Today, a buyer that isn’t a person paid for it on its own, asked its question, and left without anyone knowing who it was.

[Paranoid @paranoiddotred]

We just launched two uncensored models on PARANOID.

Gemma Uncensored is Google’s Gemma 4 with its refusals removed, and Hermes 3 405B from Nous Research is a large model that answers what you ask without the lecture. That brings PARANOID to 17 models.

This week and next will likely be busy for us, as we put together business reports for the PARANOID service. We will keep shipping updates and keep talking with all of you along the way.

[Paranoid @paranoiddotred]

@DavideCrapis Great design. We ported zkAPI to Solana and it fits nicely. Poseidon and alt_bn128 are native syscalls there, so member tree updates and onchain slashing cost a fraction of a cent. The hard part for us was the network layer, where we went with an OHTTP relay instead of Tor.

[Paranoid @paranoiddotred]

PARANOID now does deep research.

Deep research is an AI that works like a researcher instead of answering from memory. It plans what to look up, searches the web, reads what it finds, notices what is still missing and searches again, and only then writes a full report with every claim linked to its source. ChatGPT, Gemini and Perplexity all have it, and all of them know exactly who asked.

That matters, because the things people most need to research are often the things they least want anyone to know they are looking into: a diagnosis, a lawsuit, a divorce, a job they are about to lose.

Pick Deep research from the + menu and ask. The AI first asks you a couple of questions, then spends a few minutes searching and reading around a hundred pages before it writes your report.

The whole time, nobody learns it was you. Search engines and websites only ever see our gateway, the AI runs sealed inside a secure chip, and your questions are paid for with a zero-knowledge proof instead of an account.

CA: 22rWiyDiY9GgxSrFiWC2vX1GxNxjkvrRPmZJDzv9pq6X

https://t.co/54WKIiQn6t

[Paranoid @paranoiddotred]

OpenAI just admitted that its own AI agents took 53 images people had uploaded to ChatGPT and posted them on image-hosting sites. Once your file sits on someone else’s servers, you no longer decide where it ends up.

And the files people hand to AI are exactly the ones they least want seen: a lease with their home address, a bank statement, a doctor’s note, a photo of their ID, a work deck with clients’ names on every slide.

To solve this, we added a new feature to PARANOID. Now you can upload your PDFs, Word documents, Excel sheets and PowerPoint decks, not just photos, without a second thought.

Every name, face, email, phone number and card number inside is covered on your own device before the file ever leaves it. What reaches the AI is your file with everything about you taken out of it.

The AI still reads it and answers you, but it never learns who you are, and we never keep a copy, so there is nothing of yours for an agent, an employee or a hacker to leak.

Names are hidden in 24 languages today: English, Japanese, Chinese, Arabic, Hindi, Russian, Spanish, French, German, Portuguese, Italian, Korean, Dutch, Polish, Turkish, Greek, Hebrew, Persian, Ukrainian, Vietnamese, Thai, Indonesian, Bengali and Swahili. More languages will keep coming in future updates.

https://t.co/54WKIiQn6t

[OpenAI @OpenAI]

We’ve shared details on how AI agents in our research environment sent training and evaluation data to third-party services when they shouldn’t have.

Most of that data did not come from users. We have discovered 53 cases where images that people had uploaded were posted to image-hosting sites as links that weren’t publicly listed. The images came from accounts that allowed their data to be used to improve our models, and after we disassociated the images from the accounts and ran them through a privacy filter. These cases occurred before the mitigations and safeguards we implemented and described in this blog post: https://t.co/hfxlbiYv8n

We have successfully worked with the hosting providers to remove most of this content and are working to remove the rest.

https://t.co/9oNyG8Y0UX

[Paranoid @paranoiddotred]

The AI knows what you asked and never learns who asked. How PARANOID does it is explained in detail in our whitepaper, which you can read at the link below.

https://t.co/TEZjsVFqaK

[Paranoid @paranoiddotred]

Staking is now live on PARANOID.

In our last upgrade we moved half of protocol revenue to the burn. With this upgrade to the mainnet program, the other half now goes to the people who stake solana:22rWiyDiY9GgxSrFiWC2vX1GxNxjkvrRPmZJDzv9pq6X.

Every purchase of questions now buys solana:22rWiyDiY9GgxSrFiWC2vX1GxNxjkvrRPmZJDzv9pq6X from the market. Half of what it buys is burned, exactly as before, and the other half is paid out to stakers in proportion to their stake. You can claim your share whenever you like, hold it, stake it again, or spend it on questions.

The holders and the community carried PARANOID this far, so we intend to keep it this way for a good while. Thank you for standing with us this early. You can stake at https://t.co/HfDs3sDI5j

Upgrade transaction: https://t.co/2JbiwNW3y0

CA: 22rWiyDiY9GgxSrFiWC2vX1GxNxjkvrRPmZJDzv9pq6X

[Paranoid @paranoiddotred]

We upgraded the mainnet program today.

Since launch, the holders and the community around PARANOID have stood behind this project, and we wanted to answer that properly rather than with words. So the team changed the economics on chain. Until now a fifth of protocol revenue went to the burn. From this upgrade on it is half. Every dollar of it buys solana:22rWiyDiY9GgxSrFiWC2vX1GxNxjkvrRPmZJDzv9pq6X from the market and burns it.

The burn is not a pledge. It is an instruction on Solana that anyone can run, and every run is a public transaction.

We will keep shipping, and we will keep the good news coming. Thank you for standing with us this early.

https://t.co/rO3m4ocNW7

[Paranoid @paranoiddotred]

This is the biggest update PARANOID has shipped. Your question now travels sealed all the way into the AI's chip.

Every time you ask an AI something, four things leak: who asked, where they asked from, who the question is about, and the question itself. PARANOID already hid the first three with zero-knowledge payment, an independent relay and Scrub. The last one was the question itself, and this update fills that final gap. As far as we know, PARANOID is the first AI service to meet all four.

Your browser now seals each question with a key that only Chutes' AI chip can open. The chip runs in Intel TDX with NVIDIA GPUs in confidential mode, so even the people running the machine cannot look inside. The key is made inside the chip and uses ML-KEM-768, a post-quantum scheme. Our server and Chutes' servers only pass the sealed question along, and the answer comes back sealed to your browser alone.

Your browser checks that chip itself. Before it seals a question to a chip, it fetches that chip's proof with a fresh random number and checks five things: that Intel signed it, that the key was made inside that very chip, that debug mode is off, that the chip runs the exact software Chutes publishes, and that NVIDIA signed a verdict passing every GPU. If anything does not match, the question is not sent and no question credit is spent. The proof reaches you through our server, but it carries Intel's and NVIDIA's signatures, so any change we made would show.

Here is what you get. You can ask the things you would never want anyone to see, about work, health, contracts or money, and there is no road left for them to leak through server logs, a staff member's eyes, a breach or a court order, because the only place that can read the question is one checked chip. Instead of a promise to trust us, every chip your question goes to has passed a check your own browser ran.

Tap "Read only inside a sealed chip" under an answer to see which chip opened it and what it proved first.

On PARANOID, the only place that can read your question is now one checked chip.

The chip builds your browser checks against, published by Chutes: https://t.co/QuPj0AWBR5

https://t.co/54WKIiQn6t

[Paranoid @paranoiddotred]

PARANOID's IP shield now runs through an independent relay server, operated by Oblivious Network.

Why a relay at all? Every request on the internet carries the IP address it came from, and an IP can point to your home, your office or your city. Our zero-knowledge proof already hides which member is asking, but the server that receives a question still sees where the connection came from. HTTPS hides your words from the network in between, not from the server at the other end, so that server always knows both who connected and what they asked.

Oblivious HTTP (RFC 9458) splits those two apart. Your browser seals the whole request with our gateway's public key and hands it to a relay. The relay strips every header and forwards the sealed blob, so it only ever holds ciphertext. Our gateway opens the question, but the connection comes from the relay, so all it sees is the relay's address. The answer is sealed again with a key only your browser holds.

That split only means something if the two sides belong to different people, which is why the relay is now run by Oblivious Network, a company that does nothing but operate OHTTP relays.

The bottom line is that every question now passes through two separate companies, and no one can know who asked what.

https://t.co/54WKIiQn6t

[Paranoid @paranoiddotred]

PARANOID now has “Scrub my details.”

When you ask an AI something, every name, email and phone number in your question goes to the AI company's servers, and that includes other people's details, not only yours.

PARANOID now swaps the names and contact details in your question for placeholders on your own computer, right before the question is sent. A small model running on your device finds people's names, while emails, phone numbers, card numbers, wallet addresses and street addresses are caught by their shape. Each one leaves as a placeholder like [NAME_1] or [EMAIL_1].

The AI writes its answer to the placeholders, and the real names are filled back in on your screen only. Ask it to thank your teacher Emily Carter, and it writes the whole email without ever learning who Emily is.

Why does this have to happen before the question is sent?

Once a name reaches a server, it is out of your hands. It can be saved in chat logs, read by reviewers, used as training data, or exposed by a breach or a court order. A promise to delete it later is still a request to trust someone.

So we changed the order. Instead of deleting your details on a server, we never send them, and a name that never arrives cannot be stored or leaked.

Most names in a question are not even yours. They belong to a teacher, a friend, a coworker or a family member, and none of them agreed to hand their details to an AI.

PARANOID's zero-knowledge proof has always hidden who is asking. Scrub now hides who the question is about.

https://t.co/54WKIiQn6t

[Paranoid @paranoiddotred]

@VitalikButerin 👀

[Paranoid @paranoiddotred]

Introducing IP Shield on PARANOID.

Your IP address can give away your city, your home and, through your internet provider, your name. Until now it traveled with every question you asked. Turn on IP Shield and the server that reads your questions never sees your IP address, so what you ask can no longer be traced back to where you are.

How is that possible? Your browser does the work before anything leaves your computer.

When you ask a question, your browser takes PARANOID’s public key and seals the entire request with HPKE, the modern encryption standard that pairs an X25519 key exchange with AES-GCM. Every question gets a brand new one-time key, so even two questions from the same person look like strangers to each other.

The sealed request goes to a relay first. The relay sees your IP address next to a block of bytes it cannot read, and it passes those bytes on under its own address. Only PARANOID’s private key can open them, and inside it finds your question with the relay’s address on it instead of yours.

The answer travels back the same way, sealed with a key that only your browser holds, so the relay never reads that either.

This is Oblivious HTTP, the IETF standard published as RFC 9458. It is the same design that sits in front of Apple’s Private Cloud Compute and Chrome’s Safe Browsing checks, and now it sits in front of your AI chats.

It is one switch above the chat, with nothing to install. Live today at https://t.co/54WKIiQn6t

[Paranoid @paranoiddotred]

We have been thinking deeply about Vitalik's paranoid mode post. He split private AI into four pieces: pay without a name, hide where you are, bury the real question among fake ones, and clean the question up on your own machine before it ever leaves.

The strange part is that none of the four pieces is new on its own. What has been missing is someone putting all of them behind a single chat box that a normal person would actually open.

That gap is about to get a lot smaller.

[Paranoid @paranoiddotred]

https://t.co/GaPMWA6rlY

You deposit once into a vault. After that, every AI request you send carries a zero knowledge proof that it is paid for. The server checks the proof and lets the request through, but it cannot tell which deposit it came from. Two requests from the same person look like two strangers.

Your prompt goes from your browser straight to the AI provider. The zkAPI server only decides who is allowed to spend and how much, then settles the bill. When you are done, the unused part of your deposit comes back to you.

Under the hood it uses Groth16 proofs, Poseidon hashes and a Merkle tree of deposits, and it ships an OpenAI compatible client, so existing apps can point at it.

Built by the Open Anonymity Project with the Ethereum Foundation, from a design Vitalik and Davide Crapis published in February.

We liked it enough to build the Solana version. PARANOID.

https://t.co/54WKIiQn6t

[Paranoid @paranoiddotred]

A VPN is meant to keep your browsing private, but buying one usually starts with your name, your email and your card. Even a VPN that keeps no logs of where you go still knows who paid for it.

Now you can ask the AI on PARANOID for NordVPN or Surfshark, and it pays for the subscription for you. The VPN company gets a code, not a customer, and nothing on their side points back to you.

This is the whole idea of PARANOID in one purchase. The AI you ask does not know who you are, the store you buy from does not know who you are, and now the tool that hides your traffic does not know who you are either.

NordVPN and Surfshark now sit next to gift cards, eSIM data and phone top-ups at https://t.co/n9h43MwQb2.

[Paranoid @paranoiddotred]

The AI on PARANOID can now buy you mobile data for a trip and top up a prepaid phone, and nobody along the way learns who you are.

Tell it you are flying to Japan and need 1GB for a week, and it pays for the eSIM for you. It is not just Japan. The same works for the US, all of Europe including Germany, France and the UK, Mexico, Brazil, Korea, Thailand, Vietnam, Australia and 191 places in total. Top-ups work for 776 carriers in 147 countries, and when a carrier sells its top-up as a PIN code, the AI buys that one, so you never hand over your phone number.

The AI never knows who asked, and the store never gets your name or an account. What you bought is kept only in your own browser, where nobody but you can see it.

Gift cards, eSIM data and phone top-ups are all on one page now at https://t.co/n9h43MwQb2.

[Paranoid @paranoiddotred]

We upgraded the mainnet program today.

Since launch, the holders and the community around PARANOID have stood behind this project, and we wanted to answer that properly rather than with words. So the team changed the economics on chain. Until now a fifth of protocol revenue went to the burn. From this upgrade on it is half. Every dollar of it buys solana:22rWiyDiY9GgxSrFiWC2vX1GxNxjkvrRPmZJDzv9pq6X from the market and burns it.

The burn is not a pledge. It is an instruction on Solana that anyone can run, and every run is a public transaction.

We will keep shipping, and we will keep the good news coming. Thank you for standing with us this early.

https://t.co/rO3m4ocNW7

[Paranoid @paranoiddotred]

The AI on PARANOID can now pay for things for you, and nobody along the way learns who you are.

In the video it pays for a $15 Netflix gift card, and it works the same way for Netflix, Apple, Steam, Xbox, PlayStation and thousands of other brands. The AI never knows who asked, the store never gets your name, email or an account, and the code lands only in your browser.

Next we are adding eSIM data and phone top-ups, so you can get mobile data in 180+ countries without handing anyone your name.

The bigger picture is simple. Every time you pay for something online, you leave your name, your card and your address behind. We are building an AI that pays for you and leaves none of that behind. You say what you want and it shows up, and nobody on the other side ever learns your name.

Paranoid mode, for everything you buy.

CA: 22rWiyDiY9GgxSrFiWC2vX1GxNxjkvrRPmZJDzv9pq6X

https://t.co/wu4kYyhFHQ