Brave Software has connected its Leo AI assistant to Z.ai’s GLM 5.3 Flash through an encrypted channel designed to keep conversations private. The setup builds on an experiment Brave launched last November with NEAR AI’s trusted execution environment, or TEE.
A prompt is encrypted on the user’s device and sent using Oblivious HTTP, which separates the request’s content from its network origin. Brave’s AI Gateway forwards the encrypted prompt to the TEE without the user’s IP address.
Brave verifies the enclave’s attestation before the browser encrypts the prompt with a key tied to the TEE. The TEE decrypts it, runs the model and returns an encrypted answer for the browser to decrypt.
Read nextNvidia releases Nemotron 3.5 Super VL and adds two Bolt modelsThe TEE also handles searches
NEAR AI’s pipeline uses Intel TDX and Nvidia Confidential Compute. Its design keeps Brave from seeing the prompt and NEAR AI from identifying who sent it during the network hop. Data isolation protects prompts and responses during processing. The TEE signs responses, while attestation provides a way to check which model is running.
Leo can also search through the Brave Search API’s LLM context endpoint from inside the TEE. Those searches leave from the TEE, so the user’s browser does not send its IP address with them.
“In 2014, I argued in ‘Trust but Verify’ that users shouldn't have to place blind trust in the software they rely on,” Brave co-founder and CEO Brendan Eich said in a statement. “They should be able to verify it; this is a user-first principle. AI has raised the stakes, yet too much of it still runs on ‘trust me bro’ promises, often at the user's expense.”
Brave has more verification work planned
Apple, AWS, Google, Nvidia and Microsoft also offer forms of private cloud compute for AI. Prem AI promises encrypted inference, while other providers advertise zero data retention, a claim that is harder to verify. Running an open-weight model on local hardware is another privacy option, provided neither the model nor the machine has been compromised.
Brave plans to move enclave verification into the browser, publish a log of TEE keys and provide attestation for the exact model weights loaded into memory.
