Bitdefender unveiled a public beta for a VPN designed specifically for AI agents rather than human users. The tool creates a disposable, isolated connection for each individual prompt, which terminates once the task finishes. Available at no cost and currently limited to macOS, the service operates via Model Context Protocol.

Security can no longer stop at protecting the person behind the screen. It has to extend to the agent itself acting on their behalf.

Ciprian Istrate, Bitdefender consumer operations lead

Istrate made this statement on Tuesday as Bitdefender announced the tool from both Bucharest and San Antonio. The Romanian cybersecurity company, which launched in 2001 and claims over 580 patents with a presence in more than 170 countries, positioned this release as a fundamental shift in how security infrastructure should function.

A fundamentally different architecture

Traditional VPNs maintain a single open tunnel for all device traffic. Bitdefender's approach operates differently—it remains dormant until an agent initiates a request.

Upon activation, the system generates an ephemeral container dedicated to that single prompt. Traffic exits through a Bitdefender server, and the container dissolves when the prompt concludes, preventing any cookies, cache or session information from persisting to subsequent requests. Meanwhile, the rest of the device maintains its standard connection, allowing browsers and other applications to function unchanged.

The underlying infrastructure relies on Model Context Protocol as the server layer—the same protocol Google deployed last week to expand its Home platform to external agents, establishing it as the standard interface for connecting tools to assistants.

Four clients are supported at launch: Claude Desktop, Cursor, Codex and OpenCode. Each requires a single restart to load the configuration, with users providing telemetry consent during initial setup.

Five core protections

Bitdefender outlines its capabilities, each applying to every request routed through its tools:

  • Masks the agent's IP address, presenting the exit server rather than a residential address to target sites
  • Establishes an encrypted tunnel per request, preventing network observers from intercepting agent communications
  • Isolates sessions so that two requests from the same prompt cannot be correlated at the network level
  • Provides a clean, non-residential exit address
  • Permits routing individual requests through a selected country

The company identifies three practical applications: validating how geolocalised pages render in different markets, executing research agents from restricted conference networks, and preventing sites from linking multiple daily requests to a single household.

What the product protects and what it does not

Bitdefender displays its limitations prominently on the product page rather than obscuring them—a practice more companies should adopt.

The service safeguards network transport and IP exposure. However, it does not modify prompt content, meaning the underlying model continues to receive all standard information, including account identities. The protection is neither device-wide nor always active; it covers only traffic that agents explicitly route through Bitdefender's tools. Any content an agent retrieves using built-in browsing functionality transmits unprotected.

Should a tunnel fail, the request terminates within the container rather than silently reverting to the user's actual address. This design choice carries significance beyond its apparent simplicity. Apple released a bug last month in which Private Relay inadvertently exposed real IP addresses through WebKit—precisely the kind of failure this architecture explicitly prevents.

Conflicting messages on circumventing restrictions

The announcement materials suggest agents can operate past geo-blocks and region-locked content without revealing a user's identity.

The product page conveys a narrower scope. It explicitly states the tool will not circumvent a site's terms of service, rate limits or existing IP bans, and warns that beta testers attempting such use risk losing access. Both statements originated from Bitdefender on the same day, illustrating the tension every agent-focused product currently navigates.

Industry resistance is already underway

The conflict between agents and existing web infrastructure is actively playing out. Amazon blocked Meta's Muse from its store on Sunday night, and the company is pursuing legal action against Perplexity over shopping agents.

Payment networks have approached the same challenge from the opposite direction. Visa, Mastercard and Ant International are developing Know Your Agent frameworks based on the premise that merchants should understand what entity is making purchases from them.

Bitdefender frames its offering as the consumer counterargument: agents should operate without exposing their operator's home address.

The data supporting the case

Bitdefender references two external research findings to support its premise.

  • Pew Research Center determined that 71% of US adults believe increased AI deployment will compromise personal information security
  • The Cloud Security Alliance categorises agents as occupying an identity grey area, as they utilise workload identities, shared service accounts or the credentials of whoever operates them

This dynamic creates the problem Bitdefender addresses. Without separation mechanisms, every network an agent accesses becomes traceable to its owner's IP address.

System requirements and availability

The technical demands exceed those of conventional VPNs due to container-based isolation.

  • macOS 13 or later on Apple silicon
  • Minimum 8GB of memory
  • Approximately 10GB of available disk space
  • Intel Macs are not supported
  • Download size is 31MB

The beta phase permits four simultaneous exit locations, expanding to eight on the recommended configuration. Bitdefender will release latency measurements following the beta period, which commenced on 16 September and is scheduled to run for one month.

The release includes no team functionality—no single sign-on, device management or centralised configuration. Bitdefender targets individual developers and freelancers with this iteration.

Windows support is promised without a timeline. Pricing remains undetermined, with the company stating it will await usage patterns before establishing costs.

About Bitdefender

Bitdefender was established in Bucharest in 2001 and stands as Romania's leading cybersecurity firm. The company maintains more than 580 patents and serves customers across over 170 countries.

Britain moved in the opposite direction on VPN regulation last year, abandoning its proposal to restrict consumer VPN usage under the Online Safety Act. That debate centred on whether individuals should be permitted to conceal their IP addresses. This product reframes the question around software entities instead.

Source: The Next Web