[IDEA] Stealth Proxy for AI Agents: Masking PII and Avoiding Detection

I’m working on a tool for AI Agents (Claude, GPT, etc.) to handle the privacy/stealth issue when they browse the web.

The Problem:
When we use AI agents to perform tasks (shopping, checking accounts, etc.), they leak EVERYTHING. Real IP, PII (name/address), and session cookies to the target site and the LLM provider.

My Concept:
A Privacy/Stealth Layer that:

1. Redacts PII in real-time: Swaps your info with a "Virtual Persona" using local NER models.
2. Controlled Auth: A bridge for one-time session logins without exposing the full persistent cookie.
3. IP/Fingerprint Masking: Preventing the destination site from linking the AI agent activity to your real identity.

I’m stuck on the "Login Paradox":
If I mask the identity 100%, I can't log in to personalized sites. I'm thinking of a manual approval popup for tokens.

Questions:

• Do you guys think there's a market for this in the automation/SEO space?
• How would you handle browser fingerprinting when an AI agent is making the requests?
• Would you use this to protect your main accounts from being linked to your botting/AI activities?

Looking for some real feedbacks here.

If you can do that successfully, I think there is enough customers for you to retire comfortably on. btw fingerprint is only half the story. the other half depends on your session behavior. if the same account flips in between 2 patterns where one is an agent, it will still be detected.

or the other major perspective would be to actually use a real phone. then there is very little to detect.

interesting idea, but i’d be careful how you position it

if you market it as “stealth / avoiding detection”, it starts sounding risky fast

the stronger angle is privacy: pii redaction, temporary personas, session isolation, manual approval for logins, audit logs etc

the login paradox is real though… if the site needs your real identity, you can’t fully hide everything and still act like the real user

so i’d build it more as a privacy/control layer for ai agents, not a “make bots invisible” tool

There’s definitely a market for privacy layers around AI agents.
A lot of people are starting to realize how much data these tools leak by default.

The PII-masking angle is what caught my attention here. For AI agents that interact with multiple services, keeping sensitive data separated while still letting the agent complete its workflow seems like a genuinely useful problem to solve. The detection side also raises some interesting questions around how these systems should be designed responsibly.

For the 'login paradox', I'd keep cookies/tokens in a local credential broker and give the agent an opaque handle, scoped to one origin and allowed actions. Approvals should be enforced by that broker before sensitive writes. The destination still knows the logged-in account; the privacy gain is keeping credentials and unnecessary page data out of model context. OWASP's AI Agent Security checklist covers the permission side: https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html

nce you log in, the site knows who you are anyway. Keeping your passwords and cookies away from the AI still sounds useful though.