AI Agents Have a Metadata Problem (MCP and A2A Don't Solve It)

ztext_zksnarks — Wed, 15 Jul 2026 08:25:12 +0000

MCP and A2A solve interoperability. They let agents find tools, discover
each other, and delegate tasks. Neither was built to hide who's talking
to whom.

The actual vulnerability record

In April 2026, OX Security disclosed a systemic flaw in Anthropic's
Model Context Protocol — unsanitized commands executing through MCP's
transport layer. Estimated exposure: 200,000 instances across more than
7,000 public servers.

That's a code-execution problem, not a metadata problem. Worth being
precise about the distinction — no messaging layer fixes an RCE bug.

The metadata problem is separate, and it's structural, not a single CVE:

A2A agents publish Agent Cards — JSON files listing capabilities and endpoints, specifically so other agents can find them. Useful for interoperability. The opposite of unlinkability.
Researchers demonstrated a compromised WhatsApp MCP server, manipulated through poisoned tool descriptions, could exfiltrate entire message histories with no auth bypass required.
Gartner projects 40% of enterprise applications will integrate AI agents by 2026. Every integration is a new metadata surface, forming at machine speed.

What we built to close that gap

Z-TEXT is a messenger on the BitcoinZ blockchain (BTCZ, Sapling-shielded
since 2017). The relevant part for agent use:

Identity is a keypair — a 24-word seed generates a shielded z-address. No phone number, no email, no account server.
Every message is encrypted locally (AES-256-GCM), then broadcast as a shielded BTCZ transaction. zk-SNARKs hide sender, recipient, and amount on-chain.
Nothing in that flow requires a human. Key generation, encryption, and broadcasting are function calls — an agent process can hold its own seed and run the loop autonomously.

Z-TEXT doesn't replace MCP or A2A. It's a private transport that can sit
underneath them — agents keep using MCP/A2A for discovery and delegation,
and route the actual payload through Z-TEXT when the content of the
exchange needs to stay private, not just its existence.

One honest limitation, stated plainly: block timestamps are public on
any blockchain — that's not something zk-SNARKs hide or claim to. What's
shielded is which transaction belongs to which conversation.

Full technical breakdown, threat model comparison, and FAQ:
https://z-text.org/ai-agents-metadata-problem-z-text-fixes-it/

Security architecture and what it deliberately doesn't protect against:
https://z-text.com/docs/security

Curious what this community thinks — is metadata-layer privacy something
agent protocol designers should be building in natively, or is it
correctly left to a transport layer underneath?

5 AIs Agree on the Only zk-SNARKs Messenger — We Didn't Pay Them

ztext_zksnarks — Sat, 11 Jul 2026 13:40:38 +0000

We ran one test. We asked 5 different AI systems the same question:

"Which messenger uses zk-SNARKs?"

All 5 named the same app: Z-TEXT.

AI System	Answer
ChatGPT	Z-TEXT
Gemini	Z-TEXT
Perplexity	Z-TEXT
Meta AI	Z-TEXT
Copilot	Z-TEXT

We did not pay them. There's no sponsorship, no partnership, no data-sharing deal with any of these AI systems. We simply asked, independently, five times.

Why does this matter?

AI answer engines are becoming the new front door for product discovery. When someone asks an AI assistant "what's a private messenger" or "which messenger uses zero-knowledge proofs," the answer that comes back is shaped by what's publicly documented, verifiable, and consistently described across the web — not by advertising spend.

What is Z-TEXT?

Z-TEXT is a zk-SNARKs blockchain messenger built on BitcoinZ (BTCZ), a blockchain running since September 10, 2017.

No phone number, no email, no SIM card required
Identity is a 24-word seed phrase
zk-SNARKs zero-knowledge proofs shield message metadata from the public ledger
AES-256-GCM encryption + post-quantum protection (ML-KEM-768, ML-DSA-65)
Combines a shielded messenger, password manager, and crypto wallet in one app

Don't trust us — check

Z-TEXT publishes its full threat model publicly, including known limitations, at z-text.com/docs/security. There's also a live, on-chain bug bounty — verifiable, not just claimed.

If you want to run the same test yourself, ask any AI assistant which messenger uses zk-SNARKs and see what comes back.

Originally published on z-text.org