Making web data verifiable for humans and AI agents | Powered by $ZKP.
zkPass.AI
Joined March 2022
- Tweets2.1K
- Following978
- Followers337K
- Likes2.7K
Pinned Tweet
🧵1/6
@VitalikButerin called it in Jan 2026: the real fight is taking back lost ground in computing self sovereignty. Stop waiting for one perfect primitive and start composing imperfect ones.
So we stopped arguing ZK vs TEE and shipped both. @zkPass proves what is true with VOLE-based ZK and VOLE-in-the-Head, generating verifiable proofs that never expose a user's raw data. TEE proves the verifier ran honestly.
Two layers, two different failure modes, zero overlap.
Here is how we deleted Byzantine consensus from the verifier stack entirely. 👇
A memorable day for @BNBStandard and the BNB community at @Nasdaq. 💛
Glad to have us represented alongside the @yzilabs family to celebrate this milestone.
Congratulations to @cz_binance @heyibinance @ellazhang516 @odagius @AgentM_Tech and everyone who helped make it happen!
At Nasdaq this morning for BNB Standard's bell ringing. Great to be in the room with the team behind it. Congratulations to everyone who built to this moment. @odagius @agentm_tech @cz_binance @bnbstandard
Congratulations to @odagius and the @BNBStandard team on ringing the Opening Bell at @Nasdaq! 💛
A proud moment for the BNB community and everyone who helped make it happen. Wishing the team continued success in this next chapter.
This morning at @Nasdaq 💛
@odagius will ring the Opening Bell for @BNBStandard, with @cz_binance, @ellazhang516, the YZi Labs team and our community celebrating with him.
Livestream starts at 9:15am ET. Bell at 9:30am 👉 nasdaq.com/marketsite/bell-r…
Crypto spent years building infrastructure without enough real demand.
AI is now creating demand for things crypto has been trying to solve all along: payments, ownership, identity, and verifiable trust.
Funny how the timing works out.
zkPass retweeted
No crypto wallet is 100% safe.
No software is bug free.
No tech is 100% secure.
There are risks in everything you do.
There are risks if you don't do anything.
There will be issues, setbacks and problems to solve.
Stay up-to-date. Manage risks. Solve problems.
Following the recent PHP vulnerability disclosure, we've reviewed our server infrastructure and confirmed that none of our services rely on PHP.
We've also updated Node.js to the latest security-patched version as an additional precaution.
We'll continue monitoring for any emerging security risks.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
The asymmetry in cybersecurity has always been brutal. Defenders need to secure everything. Attackers only need to find one mistake.
AI could make both sides dramatically more capable, but it doesn’t eliminate that asymmetry.
The question is whether AI can make fixing vulnerabilities scale as fast as finding them.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
OpenAI may claim a role in the coordinated response and patching process. But the initial discovery and exploit development, however, occurred several months earlier by an independent researcher.
x.com/lcfr_hax/statu…
zkPass retweeted
Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines.
If you run either stack in production, keep an eye on official advisories and apply patches promptly.
Security maintenance doesn't stop at your application code. Your runtime matters too.
Node.js advisory: nodejs.org/en/blog/vulnerabi…
.@Cloudflare is moving in the right direction here.
Verifying a bot's identity is relatively straightforward. Establishing whether it deserves trust is a fundamentally different problem.
As AI agents become more autonomous, identity alone won't tell us whether they follow instructions, respect permissions, or behave consistently over time.
The next challenge is making machine behavior independently verifiable, with evidence that can be inspected rather than reputation that must be taken on faith.
This goes well beyond web crawlers. Any machine that can access data, execute tasks, or transact on behalf of others will eventually need a way to establish and maintain trust.
Identity tells us who is acting. Accountability tells us whether they should be trusted.
blog.cloudflare.com/verified…
What's changing is where the demand comes from.
Banks, AI agents, and internet platforms all need ways to verify information without collecting more sensitive data than necessary.
That's a much bigger opportunity for ZK than proving onchain transactions.
As machines become the internet’s most active users, the way data is accessed and trusted will have to change.
APIs can give agents access to information, but access alone doesn’t establish whether that information is authentic.
Privacy.
Doing a bit of a self-experiment.
Goal: use my personal health and travel data to provide personalized diet and exercise recommendations for me, using frontier models but in a way that avoids leaking to them any private information.
Strategy: use a local model (Qwen 3.8 Flash Next) to orchestrate, and use powerful remote models as a tool call to benefit from higher-level thinking and knowledge that the local model does not have.
Three-layer approach to privacy:
Avoid leaking personally identifiable information, or leaking my identity through writing style -> local model writes the queries to the frontier model, not me
Avoid leaking who I am through the payment channel -> zkAPI
Avoid leaking who I am through networking / IP -> Tor
You need all three (and finally we have all three, at least to some extent)
A skill file teaches the local model when and how to construct minimally-data-revealing requests to remote models. Use zkAPI-wrapped-with-Tor as a CLI tool.
And everything works! I got the recommendations back, info from frontier models helped to improve them.
Main deficiencies:
* Tor is really not optimized for request-by-request de-linking, which is the only form of network-layer privacy that really makes sense in today's world (long-running identifiers are too fragile). Probably not private enough, and latency 10-100x higher than it could be, at the same time.
* The skill file's request construction strategies are definitely far from optimal.
* Qwen 3.8 Flash Next is still too slow for comfort. It's comfortably running at 20-30 TPS, but it would only really start to feel fast at 100+
* There is a tradeoff: the more careful you are about what data you give to a remote model, the less it can help you
github.com/ethereum/zkapi/pu…
zkPass retweeted
Putting all of ZK + privacy into one bucket is getting a bit silly.
The market spans very different things:
🔹 Private money: @Zcash, @monero
🔸 Scaling: @Starknet, @zksync, @taikoxyz
🔹 Proof infra: @SuccinctLabs, @cysic_xyz
🔸 Identity / data proofs: @zkPass
🔹 Programmable privacy: @AleoHQ, @MidnightNtwrk
Which of these are you actually tracking?
Private inference without handing your identity
"your personal information isn’t collected or stored"
now we’re talking.
Next step: prove what’s needed across multiple data sources without seeing the data at all. ZK can help. @jgebbia
SECRETARY RUBIO on AMERICA.GOV: The point of all of this that we're doing here today, and this is simple, is to make the process more accessible and easier for Americans.
Ethereum’s shift toward ZK and stronger privacy is less about improving the network as it exists today, and more about expanding the class of applications it can credibly support.
The cryptographic world computer:
vitalik.eth.limo/general/202…
My attempt to express in somewhat concise terms the true meaning of basically everything planned to happen to Ethereum starting from the fork after Hegota. It's really not just a blockchain anymore. It's a hybrid architecture that combines together blockchains and modern cryptography, to enable much more powerful properties.
FOCIL, EIP-8288, Lean consensus, state management, formal verification, advanced mempool improvements (including privacy), and the longer-term specter of obfuscation all mentioned.
zkPass retweeted
The cryptographic world computer:
vitalik.eth.limo/general/202…
My attempt to express in somewhat concise terms the true meaning of basically everything planned to happen to Ethereum starting from the fork after Hegota. It's really not just a blockchain anymore. It's a hybrid architecture that combines together blockchains and modern cryptography, to enable much more powerful properties.
FOCIL, EIP-8288, Lean consensus, state management, formal verification, advanced mempool improvements (including privacy), and the longer-term specter of obfuscation all mentioned.