Another Brave User-First AI Win: Leo adds End-to-end Encryption, Oblivious HTTP, and Verifiable Confidential Computing

Brave AI chat (Leo), the AI assistant built into the Brave browser, now offers industry-leading privacy you can verify. Conversations with the open-weight GLM model in Leo are protected by end-to-end encryption and hardware-backed confidential computing. Your Brave browser encrypts each prompt on your device, before leaving your device, such that only an attested Trusted Execution Environment (TEE) can decrypt your prompts and run confidential LLM inference on it.

Here’s how it works, in a nutshell:

• Cryptographic proof, not just privacy promises . Before any prompt leaves your browser, the TEE must present hardware-signed attestation that’s verified to confirm the authenticity of the secure hardware, and the integrity of the model and publicly auditable code running inside it.
• Encrypted at the source before leaving your device. Your Brave browser encrypts each prompt using Oblivious HTTP (OHTTP) before it leaves your device, ensuring that only the attested TEE can decrypt it.
• Your IP address stays hidden . Your browser sends the encrypted prompt through Brave’s open-source AI Gateway, which hides your IP address from the AI provider, NEAR AI.
• Confidential LLM inference, protected by hardware . The GLM 5.3 Flash model runs inside a sealed, Nvidia-backed hardware enclave, operated by NEAR AI. Hardware-enforced isolation protects your prompts and responses from infrastructure operators, including Brave and NEAR AI.

Available today in Brave Release, Beta, and Nightly. This marks another step toward user-first AI, building on our November 2025 announcement, “Verifiable Privacy and Transparency: A new frontier for Brave AI privacy”.

Your most private questions, and how AI chatbots have exposed them #

It’s 11 p.m. Your lab results have just landed in your patient portal, and one number is flagged in red. Your doctor’s office won’t open until Monday, so you ask the AI assistant beside the page what it means. Across town, someone has a debt collector’s letter open in a tab and asks the AI to explain their rights. Someone else, with a divorce settlement on screen, asks what they’re about to sign. A manager asks for a summary of the confidential layoff plan in her inbox, while one of her employees, reading the company’s HR policy, asks whether he has a case against her. Every one of them assumes the conversation, and the page beside it, will stay private.

These are the conversations people now have with AI, and together with the pages they share, they reveal far more than a search query ever could. OpenAI CEO Sam Altman has said people use ChatGPT “as a therapist, a life coach”. In a 2026 KFF poll, a third of U.S. adults said they’d turned to AI chatbots for health information, and 41% of them had uploaded personal medical information such as test results or doctors’ notes. OpenAI itself reports that more than a million ChatGPT users a week have conversations showing signs of suicidal planning. And at work, a 2025 LayerX report found that 77% of employees who use AI tools paste data into them, with more than a fifth of those pastes containing personal or payment-card information.

With most AI services, every one of those conversations, and every page shared along with them, sits on someone else’s servers, readable by the AI company and the other companies behind it. Once they’re there, five things can go wrong:

• Used to train the next model. A2025 Stanford study found that six leading U.S. AI developers appear to train their models on users’ chats by default, and some keep those chats indefinitely.
• Handed over to a court. In the New York Times’ copyright lawsuit, a federal judge ordered OpenAI to preserve users’ ChatGPT conversations, including deleted ones, and then, in November 2025, tohand over 20 million de-identified chat logs . OpenAI said it knew of no court ever ordering “wholesale production of personal information at this scale ”. Sam Altman had warned months earlier that if there’s a lawsuit or order demanding data, “we could be required to produce that.”
• Leaked through bugs and open databases. In March 2023,a ChatGPT bug showed some users the titles of other people’s conversations. In January 2026, the popular Chat & Ask AI app left its database open,exposing about 300 million messages from more than 25 million users , including some of their most sensitive questions.
• Published for anyone to find. In 2025,more than 370,000 Grok conversations became searchable on Google after shared links were indexed without users’ knowledge, andthousands of shared ChatGPT conversations turned up in search results before OpenAI pulled the feature. Meta AI’s Discover feed filled with medical and legal questions from peoplewho didn’t realize they had posted them publicly . Even among conversations people shared on purpose,a 2026 study of 100,342 of ChatGPT, Copilot, and Gemini conversations found sensitive personal data in about 8%.
• Answered by a different model. Providers canquietly substitute another model for the one you selected, and a NeurIPS 2025 study found such swaps can’t be reliably detected from the answers alone.

End-to-end encrypted Brave AI is built so that none of this can happen to your conversations. Brave and NEAR AI never hold a readable copy of your chats, so there’s nothing readable to train on, hand over, or leak. Your history stays on your device, the model’s maker never sees your words, and attestation shows which model is answering you. None of it depends on anyone’s good intentions, and the rest of this post shows how it’s enforced and how you can check it yourself.

Privacy risks in AI are also starting to resemble the ones Brave has long fought on the web to protect user privacy. When a provider holds your conversations and no one can independently verify what it does with them, new uses can appear quickly and quietly, and your chats can become one piece of a wider profile. In September 2026, security researcher Buchodi reported that OpenAI’s ad system sets a cookie tied to your ChatGPT account that gets sent back to OpenAI from advertisers’ websites, along with the pages you visit there. OpenAI cookie policy lists it as an “analytics” cookie, not a marketing one, so even people who disable marketing cookies still receive it. In Buchodi’s tests on Chrome for Android, this mechanism could allow OpenAI to link your browsing on those sites, including pages about medical conditions or debt, to your ChatGPT account and ultimately to you. Brave users are protected because Brave browser blocks the cross-site cookies this tracking depends on by default. Without verifiability, you learn what happens to your data only when an outside researcher catches it.

Openness, transparency, and verifiable privacy: Brave principles older than AI, now built into Brave AI #

In 1883, cryptographer Auguste Kerckhoffs argued that security shouldn’t depend on keeping a system’s design secret: a good system stays safe even when everyone can see how it works. A century later, Unix co-creator Ken Thompson, in his 1983 Turing Award lecture “Reflections on Trusting Trust” showed that public source code can still deceive you: a compromised compiler can insert a backdoor that appears in no source code. His conclusion was stark: “You can’t trust code that you did not totally create yourself.” Since no one writes all their own code, the lesson we draw is that openness matters, but it isn’t enough. You also need to verify what actually runs.

This thinking shaped Brave long before today’s AI boom. In 2014, Brendan Eich, who went on to co-found Brave with Brian R. Bondy, co-authored Trust but Verify, warning that browser vendors could be compelled to secretly ship surveillance code. Citing Thompson’s attack, it called for independent verification: researchers rebuilding software from public source code and checking that it matched what users actually received. Brave carries that forward: our browser is developed in public, and its code is open source.

AI raises the stakes. As the previous section showed, people share their most personal information with AI assistants with little visibility into who can read it, how it’s processed, or even which model is responding. Too often, privacy comes down to a provider saying “trust us.” That’s privacy perfume: reassuring claims sprayed over systems no one can check.

At Brave, we believe privacy should be something you can verify, and Brave AI puts these principles into practice:

• Openness: the protocol, the relay, the verifier, the model’s weights, and NEAR AI’s code running inside the TEEs are all public. As Kerckhoffs would have it, the only secrets are the keys, and the one that unlocks your conversation, the TEE’s private key, never leaves the TEE.
• Transparency: this post and the code behind it show exactly where your data goes and who can see what, and attestation confirms that your answers come from the model you chose, not a cheaper substitute.
• Verifiable privacy: attestation proves which code is actually running inside the TEE, and our verification oracle rebuilds NEAR AI’s code from public source to confirm it matches. That’s a practical step toward solving Thompson’s problem. Only then does your browser get the key it needs to lock your conversation end to end, so that only the TEE can unlock it.

Others call open-weight models promising: Brave runs them in production #

At Brave, we’ve been turning the promise of open-weight models into products people use every day. Leo launched in fall 2023 with the open-weight Llama 2 model as its free default, then replaced it with Mixtral a few months later. Today, Leo offers open-weight models such as Qwen, DeepSeek, Kimi, Mistral, and Nvidia’s Nemotron, hosted by Brave. And openness doesn’t mean compromising on quality: in our latest head-to-head evaluation, from June 2026, Ask Brave, powered by open-weight Qwen3 and Brave’s LLM Context API, outscored every AI answer engine we tested, including Grok, Google AI Mode, ChatGPT, and Perplexity.

Now we’re taking open-weight AI a step further: from performance to verifiable privacy. GLM 5.3 Flash, which Z.ai released with open weights under the permissive MIT license in August 2026, now powers end-to-end encrypted Brave AI. Open weights let an independent operator, NEAR AI, host GLM 5.3 Flash entirely inside attested hardware, so Z.ai, the company that built it, never sees your conversations. And because the weights are public, the model the TEE attests to is one anyone can download, inspect, and benchmark. Closed models can run in TEEs too, but only under their makers’ control, with weights no one else can examine.

Still, open weights aren’t enough. They show what a model is, not how it was made, and they can’t rule out malicious changes to the weights: researchers have shown that backdoors can be planted in a model’s weights in ways that are, in some cases, provably infeasible to detect. That’s why openness has to extend to training. Nvidia now releases its Nemotron models with much of their training data and their training recipe, not just their weights. But open training matters only if you can verify it, and today it has a reproducibility problem: a published recipe still asks you to trust that it’s the one actually used. Verifiable open training closes that gap. Gensyn’s open-1b makes every step of its training reproducible and checkable.

Brave Research is moving in this direction too: our Confidential-DPproof shows that training can be verified even when the data must stay private. And even a fully verified model doesn’t make AI private on its own: whoever runs it could still read your conversations. That’s why Brave AI pairs open weights with open code and verifiable hardware, so you depend far less on trusting the model’s maker, the company running it, or us. Together, they bring us closer to something AI has long been missing: privacy you don’t have to take on trust.

Our first step toward verifiable privacy and transparency in Brave AI (November 2025) #

In November 2025, Brave took its first step toward verifiable privacy and transparency in AI, bringing confidential computing to Brave AI through NEAR AI’s Nvidia-backed TEEs. The principle is simple: users must be able to verify, not just trust, that they are having a private conversation with the AI model they expect.

In the first release, the model ran inside a TEE, and user requests passed through Brave’s servers under our existing privacy protections: encrypted in transit, never logged, and discarded once a response was generated. Those protections rested on our policies, not yet on cryptography. Brave’s servers also checked the TEE’s proof and showed users a green label, so the checking, too, relied on trusting Brave.

We promised two things before a wider rollout: open-source every stage of the pipeline, including the Brave AI Gateway (the backend for Brave AI chat), and move verification closer to you. This release publishes the code for every stage, makes verification do real cryptographic work, and goes a step further with end-to-end encryption, so that even Brave, which runs the verifier, can’t read what you send.

We’re glad to have helped lead the way, and to see others now following, including OpenAI, which announced Private Intelligence last month with its private inference still to come. Brave AI’s industry-leading approach is already here: available today to every Brave user, running an open-weight model anyone can inspect, with the code for every stage public.

Today we’re taking the next step: end-to-end encrypted chat, verified before it’s trusted #

We’ve open-sourced the pipeline and made attestation a prerequisite for encryption. Your browser now encrypts each prompt to a key supplied only after the TEE passes verification. Brave relays the encrypted message without needing to read it, and the TEE decrypts and processes it inside its protected environment.

Brave AI chat with open-weight GLM 5.3 Flash, running in NEAR AI TEEs, is now end-to-end encrypted. The code that verifies the TEE, encrypts your messages, and relays them is open source.

• Sealed before it leaves your machine. Your browser encrypts each prompt and any page you share with Leo using Oblivious HTTP, an IETF standard, to a key that exists only inside a hardware-isolated, Nvidia-backed TEE. Neither Brave, NEAR AI, nor the cloud host can read it.
• Unlinked from you. TheBrave AI Gateway strips your IP address before relaying the still-encrypted message, so the TEE provider never learns who is asking.
• Only a verified TEE gets your words. Before your browser receives a key, Brave’s open-source verifier checks the TEE’s attestation: approved builds, and a key signed from inside the TEE. If the check fails, Brave won’t hand out the key or relay your message.

Together, these protect your conversation at rest, in transit, and in use. Only your device and the attested code inside the TEE can read your conversation, the intermediary relay can’t. The Brave AI Gateway checks the TEE and relays your sealed message. It sees your IP address because it relays your message but it never sees your words. Neither the TEE nor Brave Search ever sees your IP.

The next four sections walk through each step.

Step 1: The TEE proves its identity before the browser receives its key

Before your browser can encrypt anything, it needs the TEE’s public key, and that key is only handed out after the TEE proves what it is.

First, our verification oracle audits every NEAR AI TEE deployment before Brave approves it:

1. Genuine hardware . It verifies Intel’s signature on the TEE’s hardware attestation (a TDX quote), proving the CPU enclave is real Intel TDX hardware. It verifies the GPUs’ attestation with Nvidia’s Remote Attestation Service, proving the model runs on genuine, attested Nvidia GPUs.
2. Audited code, rebuilt from source. Every NEAR-authored software image must carry signed build provenance, recorded in a public transparency log, pointing to the exact source commit Brave reviewed. The oracle then rebuilds the images from that source and confirms the result matches what’s running. That’s Thompson’s lesson in practice: we verify not just the source, but what actually runs. Before Brave approves any update to NEAR’s code, the change is reviewed, including an automated privacy check that it doesn’t introduce any new way for your prompts to leak.
3. The model you chose. It confirms the attested model is the one requested, and uses a hardware-attested deployment log to prove exactly which model image is serving. The third-party model runtime isn’t rebuilt from source, so it is pinned by that log instead.
4. Keys tied to the enclave. It records a signing key only if that key is bound into a verified hardware attestation.

Every check must pass. Only then does the oracle record its approval of each software image and signing key.

Then the open-source Brave AI Gateway fetches the TEE’s live attestation for the model you selected and checks it against those approvals. The TEE’s encryption key must carry a valid digital signature from an approved signing key. Only a key that passes every check is sent to your browser, and the gateway re-checks before relaying each message, using a verification no more than an hour old. If verification fails, Brave detects the change and won’t hand out the key or relay your message.

Today, your browser relies on the gateway for this check. Next, your browser will check each key against a signed list of the oracle’s approvals itself. After that, it will verify the hardware attestation directly, so you no longer need to trust any Brave server to vouch for the TEE.

Step 2: Sealed in your browser with Oblivious HTTP

With a verified key in hand, your browser seals the message using Oblivious HTTP (OHTTP), an IETF standard, through Chromium’s built-in OHTTP support. Under the hood, OHTTP uses Hybrid Public Key Encryption (HPKE, RFC 9180):

1. For each request, your browser generates a fresh, one-time (ephemeral) X25519 keypair.
2. It runs an elliptic-curve Diffie–Hellman (ECDH) key exchange between that ephemeral key and the TEE’s public key, producing a shared secret.
3. HKDF-SHA256 turns the shared secret into a symmetric key.
4. The entire chat request, including your conversation, is encrypted with AES-128-GCM, an authenticated cipher that also detects tampering.
5. Your browser sends the ephemeral public key and the ciphertext. Only the TEE, which holds the matching private key, can recompute the shared secret and decrypt.

Replies come back sealed too. The TEE encrypts its answer, streamed piece by piece, under a key derived from the same exchange, so only your browser can read it.

Each turn is a new request: your browser generates a fresh one-time key and re-encrypts the entire conversation history.

Step 3: Your IP address, separated from what you ask

Encryption hides what you say, but whoever receives a request can still see where it came from. OHTTP’s answer is to split the job between two parties, a relay and a gateway, so that neither sees both your IP address and what you said.

Despite its name, the Brave AI Gateway plays OHTTP’s relay role, and the gateway that decrypts your message sits inside NEAR AI’s TEE. OHTTP privacy guarantees have been formally analysed.

Your browser sends the sealed message to the Brave AI Gateway, which acts as the relay. Brave sees your IP address but can’t read the message, because it’s encrypted to the TEE. Brave drops your IP and forwards the ciphertext to the NEAR AI TEE (the gateway) under Brave’s own account, so to NEAR AI every request looks like it comes from Brave. The TEE decrypts and answers the message but never learns your IP address.

This builds on Leo’s existing protections: no account or login required, no IP logging, and Premium subscriptions validated with unlinkable tokens, so payment details can’t be tied to conversations.

Step 4: Confidential LLM inference inside the TEE, including private web search

Inside the TEE, your message is decrypted and processed in hardware-protected memory: encrypted memory on the Intel TDX CPUs, firewalled memory on the Nvidia confidential-computing GPUs, and encrypted transfers between them. This is the environment the oracle verified in Step 1. Intel’s attestation proves the CPU enclave is genuine, Nvidia’s proves the GPUs are genuine and attested, and reproducible builds prove NEAR AI’s code running inside is the code Brave audited. GLM 5.3 Flash runs there, and the host machine, NEAR AI, and the cloud operator can’t see into it.

A private AI assistant isn’t much use if it can’t look things up. The model can now call a search tool directly from inside the TEE. Those calls are answered by the Brave Search API’s LLM Context endpoint. Instead of a list of links, LLM Context hands the model ranked, query-relevant passages from the web. It’s the same grounding layer behind the Ask Brave results mentioned above.

Because the model decides what to search from inside the TEE, your conversation is never decrypted outside it to do so. The search query GLM 5.3 Flash generates goes out from the TEE, not your browser, so it isn’t tied to your IP address. And these queries are covered by the Brave Search API’s zero data retention option, served from Brave’s own independent index.

You are protected at rest, in transit, and in use #

Data lives in three states: at rest (stored), in transit (moving between machines), and in use (being processed). Brave AI protects all three states:

Public, auditable code as the foundation of cryptographic verification #

Attestation proves that specific code is running. That only means something if anyone can read the code. So the code for every stage of the pipeline is public: Brave’s components are open source, and NEAR AI publishes the code that runs inside its TEEs.

• Client: the Brave browser code that fetches the verified key, seals your messages with OHTTP, and opens replies:oblivious_http_api_client.cc andoblivious_http_config_manager.cc .
• Relay and verifier: the Brave AI Gateway code that verifies the TEE’s attestation and relays sealed messages:ohttp.py andnear.py .
• Verification oracle: the system that verifies TEE builds and signing keys and records the ones that pass:near-verifier .
• Inference : NEAR AI’s code that runs inside the TEEs:inference-proxy (sits in front of the model and produces its attestations),compose-manager (launches the model and logs which one is running), andcloud-api (NEAR AI’s API gateway).

Every verification chain ends in something you have to trust. Ours ends in: Intel and Nvidia (hardware and attestation services), dstack (the enclaves’ operating system), Sigstore (build records), GitHub (source code), Hugging Face (model weights), and public DNS (certificate checks).

Try it and tell us what you think #

End-to-end encrypted Brave AI chat is available today in all channels (Nightly, Beta, and Release). Select GLM 5.3 Flash in Brave Leo to start.

The simulation below is an illustration of the experience, not a live chat. Click through it to see how an end-to-end encrypted conversation flows.

As always, we’d love your feedback.

What comes next #

Our goal hasn’t changed since our first post, and its roots go back to 2014: an AI assistant whose privacy you don’t have to take on trust, because you can verify it. Here’s what we’re working on next:

1. Verification in your browser. We’ll move attestation checks into the browser itself, and publish a log of TEE keys so anyone can confirm every user gets the same one.
2. Verified model. We’ll have the enclave attest to the exact weights it loads into memory, verify that quantized versions were faithfully derived from the original release, and bring verifiably open-trained open-weight models into Brave AI runs.
3. More Leo features in verifiably private mode . GLM 5.3 Flash is in beta, and we’re bringing more of Leo’s features and open-weight models into verifiably private chats.