Brave Software has added a confidential channel to its Leo AI assistant, letting users chat with the GLM 5.3 Flash model without exposing prompts or identities to Brave, NEAR AI, or network observers. The setup encrypts queries on-device, sends them via Oblivious HTTP so requests are separated from content, and forwards them to a trusted execution environment (TEE) built with Intel TDX and Nvidia Confidential Compute. The TEE decrypts the request, runs the model, and returns an encrypted response that only the user's browser can decrypt.
Brave says the design keeps the company from knowing what was asked and NEAR AI from knowing who asked it. Searches performed by the AI within the TEE also go through the TEE rather than the user's browser, keeping IP addresses out of the picture. Users can verify the enclave's attestation and check that responses are signed, which Brave argues addresses the "trust me bro" problem in AI.
The implementation is not fully finished. Brave intends to move the verification step into the browser, publish a log of TEE keys, and provide attestation for exact model weights loaded into memory. The company is one of several—alongside Apple, AWS, Google, Nvidia, and Microsoft—offering private cloud compute for AI, though local inference with an open-weight model remains an alternative for users who want to avoid cloud processing entirely.