Brave says conversations with the open-weight GLM model in its Leo assistant are now end-to-end encrypted, so that "even Brave can't read them, and you can verify it." Published on October 15, 2026, the announcement from Brave describes a pipeline where your browser encrypts each prompt on your device, a relay hides your IP address, and only an attested, Nvidia-backed enclave run by NEAR AI can decrypt the prompt and run the model.
It is one of the more concrete attempts yet to make a private AI chat something you can check instead of something you take on trust. This post explains the design in plain terms, what Brave says is verified, and where trust still remains. All claims below are Brave's own, from its post, unless noted.
Quick reference
| Question | Answer |
|---|---|
| What is new? | End-to-end encryption plus Oblivious HTTP and attested confidential computing for Leo chats with GLM 5.3 Flash |
| Model | GLM 5.3 Flash, released by Z.ai under the MIT license in August 2026, per Brave |
| Who runs inference? | NEAR AI, inside Nvidia-backed Trusted Execution Environments |
| Who can read prompts? | Per Brave, only your device and the attested code in the TEE |
| What hides my IP? | Brave's open-source AI Gateway strips it before the encrypted message reaches the TEE provider |
| Where is it available? | Brave Release, Beta and Nightly, per Brave |
| Earlier step | November 2025: models in TEEs, but requests passed through Brave servers under policy, not cryptography |
What changed since November 2025
Brave's first step, in November 2025, put the model inside a NEAR AI TEE; The Register's report at the time noted it was limited to Brave Nightly users. Per Brave's account, requests still passed through Brave's servers "encrypted in transit, never logged, and discarded once a response was generated", protections that "rested on our policies, not yet on cryptography." Brave's servers also checked the TEE's proof and showed a green label, so the checking relied on trusting Brave.
The new release does three things: it publishes the code for every stage of the pipeline, makes verification a prerequisite for encryption, and adds end-to-end encryption so that Brave, which runs the verifier, cannot read what you send. Our earlier post on encrypted reasoning traces shows why "encrypted" claims in AI deserve scrutiny, and Brave's design is built around exactly that skepticism.
How it works, step by step
A green bead passing through a closed lock-shaped tunnel, picturing a prompt that stays encrypted until it reaches the attested enclave
1. The enclave proves itself first. Before your browser gets any key, Brave's verification oracle audits each NEAR AI deployment. Per Brave, it checks Intel's signature on the hardware attestation (a TDX quote), checks the GPUs with Nvidia's Remote Attestation Service, rebuilds NEAR AI's code from public source and confirms it matches what runs, confirms the attested model is the one requested, and records a signing key only if it is bound to a verified attestation. The open-source gateway then checks the live attestation against those approvals and re-checks before relaying each message, using verification no more than an hour old.
2. Your browser seals the message. With a verified key, the browser encrypts the prompt, and any page you share with Leo, using Oblivious HTTP, an IETF standard, through Chromium's built-in support. Under the hood Brave describes HPKE (RFC 9180): a fresh X25519 keypair per request, a key exchange with the TEE's public key, HKDF-SHA256 to derive a symmetric key, and AES-128-GCM to encrypt the whole request. Replies are streamed back encrypted under a key from the same exchange. Each turn re-encrypts the entire conversation with a new one-time key.
3. A relay separates who you are from what you ask. Encryption hides your words but not your IP address, so OHTTP splits the work between a relay and a gateway. Brave says its AI Gateway strips your IP address before forwarding the still-encrypted message, so the TEE provider never learns who is asking, and neither the TEE nor Brave Search sees your IP. The gateway does see your IP, because it relays your message, but not your words.
4. The enclave decrypts and answers. Inside the sealed, Nvidia-backed hardware enclave, GLM 5.3 Flash processes the prompt. Brave says hardware-enforced isolation protects prompts and responses from infrastructure operators, including Brave and NEAR AI.
Why GLM 5.3 Flash
Brave chose an open-weight model on purpose. It argues that open weights let an independent operator, NEAR AI, host the model entirely inside attested hardware, so Z.ai, the model's maker, never sees your conversations, and that anyone can download and inspect the attested weights. Closed models can run in TEEs too, Brave notes, but only under their makers' control with weights nobody else can examine.
For more on the model, see our coverage of the GLM 5.3 Flash launch, its pricing and benchmark standing and how it stacks up in our small-model comparison. If privacy is your priority, remember this protection is tied to this model in this mode, not to Leo as a whole.
What Brave says it prevents
Brave's post lists five failure modes of ordinary hosted chatbots and argues the design addresses each: chats used to train the next model, chats handed to a court, chats leaked through bugs and open databases, chats published through shared links and indexed, and answers from a quietly substituted model. Because Brave and NEAR AI never hold a readable copy, Brave says, there is nothing readable to train on, hand over or leak, and attestation shows which model is answering.
Brave cites examples to make the case, including a federal order in the New York Times copyright suit for OpenAI to hand over 20 million de-identified chat logs, and a September 2026 report by security researcher Buchodi about an OpenAI ad cookie, which we covered in the ChatGPT cross-site cookie story. These are Brave's citations; we have not re-verified each one.
Where trust still sits
A fair reading of Brave's own text shows what remains:
- Brave's gateway still does the checking today. Brave says "your browser relies on the gateway" for the TEE check for now. It plans to have the browser check each key against a signed list of the oracle's approvals itself, then verify hardware attestation directly.
- Hardware vendors. The scheme rests on Intel TDX and Nvidia attestation being sound. TEEs have a history of side-channel research, and nothing in an announcement can settle that.
- Model supply chain. Brave notes open weights "show what a model is, not how it was made" and that backdoors can be planted in weights. Verifiable training is a stated goal, not a delivered feature.
- Metadata. The gateway sees your IP address and traffic timing, though not content.
- Scope. Only the GLM 5.3 Flash mode is described as end-to-end encrypted. Brave says Leo also offers other open-weight models hosted by Brave, such as Qwen, DeepSeek, Kimi, Mistral and Nvidia's Nemotron, but does not say those are encrypted the same way.
- Your device. Your history stays on your device, per Brave, so device security matters.
Anthropic's acquihire of a confidential-AI startup shows how quickly this area is moving; see Anthropic's Opaque deal. Brave also mentions that OpenAI announced "Private Intelligence" last month with private inference still to come; we have not independently checked that.
How to check it yourself
- Read Brave's post and follow its links to the open-source gateway, verifier and protocol code.
- In Brave, pick the GLM model in Leo and check what privacy indicator, if any, the interface shows. Brave's November 2025 rollout used a label tied to attestation; confirm what the current release shows.
- Inspect what the verification oracle approves: the software image hashes and signing keys.
- Rebuild NEAR AI's published code from the pinned source commit, as Brave's oracle does, and compare.
- Watch network traffic to confirm only an encrypted OHTTP request leaves the browser. You should see ciphertext, not prompts.
What it means for you
If you use an AI assistant for sensitive questions such as health, debt or legal worries, this is a meaningful improvement over a promise not to look: the claim is enforced by cryptography and can be audited. It does not make every Leo chat private, and it asks you to trust hardware attestation and, for now, Brave's gateway verification. If your threat model includes a court order, a leak or training on your chats, the design is built for that. If it includes a hostile hardware vendor or a compromised device, it is not.
For agents, the same pattern matters: see how agent sandboxes are being opened up for the other half of verifiable AI infrastructure.
Related reading
- Encrypted reasoning traces and the chain-of-thought flaw
- ChatGPT's cross-site ad cookie
- GLM 5.3 Flash launch
- GLM 5.3 Flash pricing and benchmarks
- Anthropic acquihires Opaque for confidential AI
- Small-model comparison with GLM 5.3 Flash
Details are accurate as of October 15, 2026, based on Brave's announcement. The design is Brave's own and has not been independently audited as far as we know.