Ethereum co-founder Vitalik Buterin says laptop-based AI is moving closer to everyday use, increasing the need for wallet safeguards that keep transaction control outside a model’s reach.
Ethereum co-founder Vitalik Buterin says laptop-based AI is nearing a practical breakthrough. Wallet software still needs to meet a far higher security standard before AI can be given control of crypto assets.
On Sept. 17, he said Qwen 3.8 Flash and recent llama.cpp upgrades had brought local models close to handling a “large share” of tasks on his Strix Halo laptop.
For more complex tasks, he described a local model directing requests to more capable remote systems while keeping the user’s complete personal context private.
The benchmark image shared in the post covered 10 workloads. Reported input-processing speeds ranged from 109.82 to 373.22 tokens per second, while output generation rates varied between 18.42 and 33.37 tokens per second.
Those results point to practical responsiveness on a high-end laptop, but they do not address model decision-making, protection against malicious prompts, or the authorization of crypto transactions.
Local AI inference can strengthen privacy, while the ability to move funds remains protected by separate, enforceable controls.
Ethereum Co-Founder Shows What Changed Between April and September
In an April account of his local AI setup, Vitalik outlined a more limited role for models running on laptops.
He wrote that Qwen3.5:35B could manage defined tasks and routine programming work, while advanced autonomous agents capable of continuing work on a codebase remained outside the practical limits of laptops. More demanding coding and intellectual tasks still required stronger remote models.
The September post shifts his view of where the practical limit lies. Local models no longer seem confined to transcription, summaries, or other narrowly defined tasks. In the latest description, a local model can serve as the main interface for more activity and determine when a remote model is needed.
A remote service receives only the question or context chosen by the local model, rather than the files, messages, and wallet details needed to understand the user’s broader situation. The local system therefore acts as both an information filter and an assistant.
April and September used different model generations and focused on different tasks. The September post includes token counts and performance figures, but it leaves out the prompt details, quantization settings, and complete runtime setup.
Qwen3.8-Flash-Next, developed by Alibaba’s Qwen team, is an open-weight multimodal mixture-of-experts model. Its core model contains 125 billion parameters, with another 51 billion held in n-gram embedding tables, while 6 billion parameters are activated for each token.
The official repository outlines how llama.cpp can run local text and vision inference with quantized GGUF builds.
Running only a portion of the model for each token reduces the overall computing load. Users still need sufficient memory for the selected build and context, while the official documentation does not specify one hardware minimum that fits all quantization levels and workloads.
Capability Benchmarks Leave Wallet Authority Questions Unresolved
Qwen’s technical report assesses the base model across 14 benchmarks spanning general knowledge, mathematics, science, reasoning, coding, and multilingual comprehension.
The Qwen team reported that Flash-Next outperformed the larger Qwen3.7-Plus base model on eight of the benchmarks while activating fewer parameters and requiring less computing power during training.
The report examines model performance, efficiency, and training stability. However, the benchmark set does not cover prompt-injection resistance, policy enforcement, wallet authorization, or the accuracy of autonomous financial actions.
An assistant can privately interpret a transaction, prepare calldata, or recommend a route. A signer can then approve an irreversible request that transfers assets or gives another contract permission to move them.
Improved reasoning can prevent some mistakes, but a malicious instruction embedded in a website, message, or transaction description may still alter the model’s intended plan.
The Ethereum ecosystem is already exploring an on-device version of the assistant model. In its second-quarter allocation update, the Ethereum Foundation highlighted Steward, a fully local macOS smart-account wallet designed to run its light client and AI assistant directly on the device.
The disclosure outlines the project’s funding and scope, but it does not establish production deployment, independent audit status, or authority for autonomous transactions.
Vitalik’s April wallet guidance kept that policy separate from the language model. He proposed a human-confirmation firewall for high-risk actions, set deterministic limits on transaction amounts, calldata, and transaction counts, and required a human-plus-model 2-of-2 approval rule.
A model may spot a scam pattern that a distracted person overlooks, while a person may reject an action after malicious content has influenced the model. Requiring both sides to approve risky transactions prevents either party from quietly becoming the sole point of trust.
Low-risk automation can operate within permissions defined by the software. Checking balances, preparing unsigned transactions, or working under strict spending limits can keep an assistant useful without granting it unrestricted control over funds.
Wallet Trust Depends on Rules AI Models Cannot Rewrite
EIP-7906, which is still in draft form, proposes post-transaction assertion frames that examine the final state changes produced by a transaction. An assertion can reject the resulting application state if those changes breach a defined condition.
A wallet could apply that mechanism to ensure a swap changes only authorized balances, prevent an unexpected token approval from appearing, or keep a protected account’s state unchanged. These checks match the transaction’s actual effects against clearly defined rules.
The draft also outlines the limits of the protection. An assertion that checks too little can give users false confidence. Wallet validation logic must require the intended assertion frame, while the assertion itself needs to cover every relevant state change involved in the protected operation.
Local inference and transaction assertions address separate parts of the wallet-agent challenge.
The local model safeguards context and converts natural-language intent into a proposed action, while deterministic permissions limit recipients, contracts, value, and transaction frequency. Assertions then review the final state changes, with human confirmation serving as the second factor for high-risk actions.
September’s laptop results make the first layer more convincing. They suggest a private local model can respond fast enough to manage everyday tasks and selectively tap remote intelligence. The remaining layers still hold the authority needed to protect assets.
A crypto wallet can use the model as a capable interface, planner, and monitoring tool. Trust should rest with controls the model cannot modify and an approval process that keeps the user firmly in control.Ethereum co-founder Vitalik Buterin says laptop-based AI is moving closer to everyday use, increasing the need for wallet safeguards that keep transaction control outside a model’s reach.
Ethereum co-founder Vitalik Buterin says laptop-based AI is nearing a practical breakthrough. Wallet software still needs to meet a far higher security standard before AI can be given control of crypto assets.
On Sept. 17, he said Qwen 3.8 Flash and recent llama.cpp upgrades had brought local models close to handling a “large share” of tasks on his Strix Halo laptop.
For more complex tasks, he described a local model directing requests to more capable remote systems while keeping the user’s complete personal context private.
The benchmark image shared in the post covered 10 workloads. Reported input-processing speeds ranged from 109.82 to 373.22 tokens per second, while output generation rates varied between 18.42 and 33.37 tokens per second.
Those results point to practical responsiveness on a high-end laptop, but they do not address model decision-making, protection against malicious prompts, or the authorization of crypto transactions.
Local AI inference can strengthen privacy, while the ability to move funds remains protected by separate, enforceable controls.
In an April account of his local AI setup, Vitalik outlined a more limited role for models running on laptops.
He wrote that Qwen3.5:35B could manage defined tasks and routine programming work, while advanced autonomous agents capable of continuing work on a codebase remained outside the practical limits of laptops. More demanding coding and intellectual tasks still required stronger remote models.
The September post shifts his view of where the practical limit lies. Local models no longer seem confined to transcription, summaries, or other narrowly defined tasks. In the latest description, a local model can serve as the main interface for more activity and determine when a remote model is needed.
A remote service receives only the question or context chosen by the local model, rather than the files, messages, and wallet details needed to understand the user’s broader situation. The local system therefore acts as both an information filter and an assistant.
April and September used different model generations and focused on different tasks. The September post includes token counts and performance figures, but it leaves out the prompt details, quantization settings, and complete runtime setup.
Qwen3.8-Flash-Next, developed by Alibaba’s Qwen team, is an open-weight multimodal mixture-of-experts model. Its core model contains 125 billion parameters, with another 51 billion held in n-gram embedding tables, while 6 billion parameters are activated for each token.
The official repository outlines how llama.cpp can run local text and vision inference with quantized GGUF builds.
Running only a portion of the model for each token reduces the overall computing load. Users still need sufficient memory for the selected build and context, while the official documentation does not specify one hardware minimum that fits all quantization levels and workloads.
Qwen’s technical report assesses the base model across 14 benchmarks spanning general knowledge, mathematics, science, reasoning, coding, and multilingual comprehension.
The Qwen team reported that Flash-Next outperformed the larger Qwen3.7-Plus base model on eight of the benchmarks while activating fewer parameters and requiring less computing power during training.
The report examines model performance, efficiency, and training stability. However, the benchmark set does not cover prompt-injection resistance, policy enforcement, wallet authorization, or the accuracy of autonomous financial actions.
An assistant can privately interpret a transaction, prepare calldata, or recommend a route. A signer can then approve an irreversible request that transfers assets or gives another contract permission to move them.
Improved reasoning can prevent some mistakes, but a malicious instruction embedded in a website, message, or transaction description may still alter the model’s intended plan.
The Ethereum ecosystem is already exploring an on-device version of the assistant model. In its second-quarter allocation update, the Ethereum Foundation highlighted Steward, a fully local macOS smart-account wallet designed to run its light client and AI assistant directly on the device.
The disclosure outlines the project’s funding and scope, but it does not establish production deployment, independent audit status, or authority for autonomous transactions.
Vitalik’s April wallet guidance kept that policy separate from the language model. He proposed a human-confirmation firewall for high-risk actions, set deterministic limits on transaction amounts, calldata, and transaction counts, and required a human-plus-model 2-of-2 approval rule.
A model may spot a scam pattern that a distracted person overlooks, while a person may reject an action after malicious content has influenced the model. Requiring both sides to approve risky transactions prevents either party from quietly becoming the sole point of trust.
Low-risk automation can operate within permissions defined by the software. Checking balances, preparing unsigned transactions, or working under strict spending limits can keep an assistant useful without granting it unrestricted control over funds.
EIP-7906, which is still in draft form, proposes post-transaction assertion frames that examine the final state changes produced by a transaction. An assertion can reject the resulting application state if those changes breach a defined condition.
A wallet could apply that mechanism to ensure a swap changes only authorized balances, prevent an unexpected token approval from appearing, or keep a protected account’s state unchanged. These checks match the transaction’s actual effects against clearly defined rules.
The draft also outlines the limits of the protection. An assertion that checks too little can give users false confidence. Wallet validation logic must require the intended assertion frame, while the assertion itself needs to cover every relevant state change involved in the protected operation.
Local inference and transaction assertions address separate parts of the wallet-agent challenge.
The local model safeguards context and converts natural-language intent into a proposed action, while deterministic permissions limit recipients, contracts, value, and transaction frequency. Assertions then review the final state changes, with human confirmation serving as the second factor for high-risk actions.
September’s laptop results make the first layer more convincing. They suggest a private local model can respond fast enough to manage everyday tasks and selectively tap remote intelligence. The remaining layers still hold the authority needed to protect assets.
A crypto wallet can use the model as a capable interface, planner, and monitoring tool. Trust should rest with controls the model cannot modify and an approval process that keeps the user firmly in control.
