Bitdefender launches a free beta VPN built for AI agents

Bitdefender VPN for AI Agents gives each agent prompt its own disposable, encrypted connection. It is free in beta, macOS-only on Apple silicon, and works with Claude Desktop, Cursor, Codex and OpenCode.

The Proof DeskSep 23, 2026 · 5 min read

Diagram of an AI agent sending traffic through a disposable encrypted tunnel to the web while the user's device stays on a normal connection

Bitdefender has opened a free public beta of Bitdefender VPN for AI Agents, a standalone product that routes the web requests of AI agents through short-lived, encrypted connections instead of through your own IP address. The company announced it in a press release on September 22, 2026, and coverage followed across the tech press on September 23.

The idea is narrow on purpose. A classic VPN tunnels your whole device all the time. This one wakes up only when an agent such as Claude Desktop, Cursor, Codex or OpenCode calls it, opens a private connection for that single prompt, and throws it away when the task ends.

What Bitdefender announced

In its press release, Bitdefender describes the product as "a new consumer offering built to protect the privacy of the AI agents now browsing, researching, and transacting on users' behalf." It is available now as a public beta for macOS, free for the length of the beta, and in English only at launch.

Ciprian Istrate, senior vice president of operations for Bitdefender's Consumer Solutions Group, framed the launch around agents becoming stand-ins for their users: "security can no longer stop at protecting the person behind the screen; it has to extend to the agent itself acting on their behalf."

Status: public beta, free with no traffic caps, according to the product page.
Platform: macOS 13 or later on Apple silicon (M1 or later). Intel Macs are not supported.
Agents supported at launch: Claude Desktop, Cursor, Codex and OpenCode.
Account: a standalone product with its own sign-in. No other Bitdefender subscription is needed.
Next: Windows support is listed as "to follow", with no date given.

How it works: one prompt, one container

The product is built on the Model Context Protocol (MCP). Bitdefender installs a small broker and an MCP server, and the supported agent restarts once to pick up the new configuration. From then on the tool stays dormant until the agent decides to use it.

When it is called, it spins up a disposable, isolated container for that one prompt, scoped to a single location. The request travels through its own encrypted tunnel to a Bitdefender exit server, so the destination site sees Bitdefender's exit IP rather than your home address. When the prompt ends, the container and tunnel are destroyed, along with any cookies, cache or session state.

Six-step flow from AI agent to Bitdefender MCP server, disposable container, encrypted tunnel, website seeing the exit IP, and container destroyed — The tool names come from the illustrative connection log on Bitdefender's product page.

Bitdefender's product page adds a safety detail worth noting: if the tunnel fails, the request is dropped inside the container and there is no automatic fallback to your own IP. Users can also ask for a specific country, and route that one request through a Bitdefender server there. Up to 4 exit locations can run at once on the minimum spec and 8 on the recommended spec.

How it differs from a classic VPN

Bitdefender draws the contrast directly: "A classic VPN is persistent, maintaining one continuous connection for everything on a device." VPN for AI Agents instead "establishes a private connection for each prompt while the rest of the device stays on its regular connection." Your browser and other apps are not affected.

Comparison table of a classic VPN and VPN for AI Agents across connection, traffic covered, browser and apps, and lifetime — Only traffic the agent sends through Bitdefender's MCP tools uses the agent VPN.

The company pitches this as a work enabler as much as a privacy tool: an agent can compare prices or check region-specific pages across several countries in one pass, work that would otherwise mean switching a VPN country by country.

What it does not protect

The product page is unusually direct about its limits, and they matter more than the headline.

Two cards listing what VPN for AI Agents covers and what it does not, with macOS and Apple silicon requirements underneath — Requirements reflect the beta build, per Bitdefender.

Prompts are not hidden from your AI provider. The press release says the tool protects "network transport and IP exposure, not prompt content."
Coverage is not guaranteed. The agent decides when to call the VPN, and requests it makes with its own built-in tools, outside Bitdefender's MCP server, are not routed through it.
It is not a way around site rules. Bitdefender says using it to evade rate limits, bans or scraping restrictions breaks its acceptable use policy and can cost you beta access.
There is no stated no-logs policy. Setup includes consent to telemetry, which falls under Bitdefender's privacy policy.

Mixed messages on geo-blocks

The press release says agents "can work past geo-blocks and region-locked content." The product page is narrower: a requested region is honored "as long as the target site isn't geo-blocked," and the tool "isn't a workaround for anyone's terms of service." Treat the product page as the operative rule.

Requirements, pricing and what comes next

The installer is 31 MB, but the container engine that isolates each prompt sets a higher floor: 8 GB of memory and about 10 GB of free disk space at minimum. Bitdefender recommends macOS 15 or later and 16 GB of memory or more for testing.

The beta is free. On later pricing, Bitdefender only says that "Pricing decisions, if any, will follow real usage data." The beta targets individual developers and freelancers; there is no SSO, MDM or central configuration for organisations yet. Bitdefender also plans to publish real latency figures after the beta.

One date detail is unclear. The press release, dated September 22, calls this a public beta. The product page FAQ describes an external beta that started on September 16 and runs for one month.

Frequently asked questions

Is Bitdefender VPN for AI Agents free?

Yes, during the beta. Bitdefender says it is free with no traffic caps and has not announced any pricing after the beta ends.

Does it work on Windows or Intel Macs?

No. It requires macOS 13 or later on Apple silicon (M1 or later). Windows support is planned but has no date.

Which AI agents does it support?

Claude Desktop, Cursor, Codex and OpenCode at launch. Each app restarts once to load the MCP configuration, with no files to edit.

Will my AI provider still see my prompts?

Yes. The tool masks the IP address that websites see. It does not hide prompt content or your account from the company that runs your AI model.

Do I need a Bitdefender subscription?

No. It is a standalone product with its own sign-in and no dependency on other Bitdefender subscriptions.

Key takeaways

Bitdefender VPN for AI Agents is a free public beta, announced September 22, 2026, that gives each agent prompt its own disposable, encrypted connection.
It runs as an MCP server for Claude Desktop, Cursor, Codex and OpenCode, and only on Apple silicon Macs for now. Windows is to follow.
It masks the IP that websites see, not your prompts, and only covers traffic the agent sends through Bitdefender's MCP tools.
Bitdefender has not published a no-logs policy or post-beta pricing.