Want your AI chats to stay private? Brave TEEs up end-to-end encryption
Brave has connected its Leo assistant to Z.ai’s GLM 5.3 Flash model through a confidential computing system designed to keep users’ prompts and replies private. The approach uses encryption and trusted hardware to limit what Brave, the AI provider and network intermediaries can learn, offering users a way to check parts of the system’s security rather than relying solely on providers’ assurances.
Prompts are encrypted on the user’s device and sent through Oblivious HTTP, which separates the request from the user’s IP address. A trusted execution environment, built with Intel TDX and Nvidia Confidential Compute, processes the request and returns an encrypted, signed response; Brave Search queries made by the assistant also pass through the enclave. The system is still being developed: Brave plans to move verification into the browser, publish a log of enclave keys and attest to the exact model weights in use.
- Brave adds confidential AI chats to its Leo assistant.
- Prompts are encrypted and processed in a trusted execution environment.
- Browser based verification and model checks are still planned.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Confidential computing could give people stronger privacy when using AI by limiting what providers and intermediaries can see, while letting users verify some security claims instead of relying only on assurances. If Brave completes its plans for in-browser checks and model-weight attestation, this could make private AI assistance more practical without requiring users to run models themselves.
The case against
The protections rely on trusted hardware and a complex chain of encryption, network routing and provider systems, so they may reduce exposure without guaranteeing that prompts and replies are private in every circumstance. The service is still under development, and until users can verify the enclave and the exact model in use, they must place some trust in Brave, its providers and the hardware security behind the system.