Brave Encrypts Leo Chats While Its Gateway Still Vouches

Brave now encrypts Leo chats with GLM 5.3 Flash inside a NEAR AI hardware enclave, while its own gateway still checks that hardware.

The feature shipped on October 15, 2026, in Release, Beta, and Nightly. It covers one model, and Brave has not dated the remaining verification work.

On-Device Encryption With Oblivious HTTP

A prompt in this mode is sealed on the laptop or phone before it hits the network. Brave encrypts the text, and any page you share with Leo, to a key that exists only inside a hardware-isolated enclave run by NEAR AI. The browser then sends that ciphertext through Brave’s open-source AI Gateway, which strips the IP address so NEAR AI never learns who is asking.

The wrap uses Oblivious HTTP, an IETF standard, via Chromium’s built-in support. For each turn the browser makes a fresh one-time X25519 key, runs a Diffie-Hellman exchange with the enclave’s public key, and encrypts the whole chat request with AES-128-GCM. Replies come back sealed under a key from the same exchange, so only that browser can open them. Each new turn re-encrypts the full history.

Brave’s co-founder and CEO, Brendan Eich, put the pitch in a statement carried by NEAR AI: too much AI still runs on “trust me bro” promises. The October 15 design is meant to make the claim checkable. In Brave’s own test, a 19.9-second chat request spent 297 microseconds encrypting the prompt and 5.76 milliseconds decrypting the streamed reply, or 0.0015% and 0.03% of the wait.

Who Sees Your IP, and Who Sees Your Words

OHTTP splits the job so no single party in the path holds both your address and your question. Despite its name, the Brave AI Gateway plays the relay. The party that decrypts sits inside NEAR AI’s enclave. Brave published the split like this.

WHAT EACH HOP CAN SEE

Leo still needs no account. Premium is checked with unlinkable tokens, so a card is not tied to a chat. If the model searches the web, the query leaves from inside the enclave through the Brave Search API’s LLM Context endpoint, not from the browser, and those calls use the Search API’s zero data retention option on Brave’s own index.

That matters because people already dump medical and money questions into chatbots. A 2026 KFF poll found a third of U.S. adults had turned to AI chatbots for health information, and 41% of them had uploaded test results or doctors’ notes. A 2025 LayerX report found 77% of employees who use AI tools paste data into them, with more than a fifth of those pastes holding personal or payment-card information. A federal judge also ordered OpenAI to hand over 20 million de-identified ChatGPT logs in a copyright case. Brave’s claim is that a sealed prompt leaves nothing readable to train on, leak, or produce in court.

A 320-Billion-Parameter Model, One Enclave

The encrypted path is not a Leo-wide default. It runs only when you pick GLM 5.3 Flash, which Z.ai released on August 26, 2026, with open weights under the MIT license. Brave says those public weights let NEAR AI host the model inside attested hardware so Z.ai never sees the chats, and so the hash the enclave attests to is a model anyone can download.

GLM 5.3 FLASH AT A GLANCE

• Size: 320 billion total parameters, 18 billion active per token, mixture of experts.
• License: MIT open weights on Hugging Face, which is why an independent operator can run it.
• Where it runs here: a sealed Nvidia-backed enclave on Intel TDX, operated by NEAR AI.
• Who gets it: every Leo user who selects that model in Release, Beta, or Nightly; the model is still labelled beta.

NEAR AI said Brave serves over 128 million monthly active users, and that this release moves confidential inference off Nightly and into the production browser for anyone who picks GLM 5.3 Flash. The company described the work as private inference from NEAR AI Cloud, with the host OS, the GPU operator, and NEAR AI locked out at the hardware level. Venice AI, Abound, and the Government of Bermuda already run production jobs on the same cloud.

Open weights still do not prove how a model was trained. Brave’s post notes that backdoors can be planted in weights in ways that are, in some cases, infeasible to detect, which is why it wants attested training later. For this launch, the third-party model runtime is not rebuilt from source. It is pinned by a hardware-attested deployment log instead.

The Gateway Still Hands Out the Encryption Key

Before the browser receives a key, Brave’s open-source verifier checks Intel’s signature on a TDX quote, checks the GPUs against Nvidia’s attestation service, and rebuilds NEAR AI’s code from public source. No pass, no key. The gateway then re-checks live attestation against those approvals, using a verification no more than an hour old, before it relays each message.

That check does not yet happen in the browser. Brave wrote it plainly: today the browser relies on the gateway for this step. Next, the browser will check each key against a signed list of the oracle’s approvals, then verify the hardware attestation directly, so you no longer need to trust a Brave server to vouch for the TEE.

AI has raised the stakes, yet too much of it still runs on ‘trust me bro’ promises, often at the user’s expense. With the NEAR AI integration in Brave Leo, we’re bringing unmatched ‘trust but verify’ principles to AI: your conversation is sealed in your browser, opened only inside verified TEEs hosting your choice of open-source models, and the code that proves privacy is open for anyone to check.

Brendan Eich, co-founder and CEO of Brave, in a statement published by NEAR AI

The encryption is real. The other “end” is still a remote enclave on Intel and Nvidia silicon that Brave does not own, which is why the end-to-end label is a stretch for anyone who reserves that phrase for two devices the user controls. Brave’s own post lists the roots of trust as Intel and Nvidia, dstack (the enclave OS), Sigstore, GitHub, Hugging Face, and public DNS. Calling the chats private from Brave is fair on the ciphertext. Calling the whole path user-verified is ahead of the code that is shipping.

Brave announced the launch on X the same day.

Leo, the AI assistant in Brave, now offers end-to-end encrypted chat with GLM 5.3 Flash!

Your browser encrypts each prompt before it leaves your device, so only an attested Trusted Execution Environment (TEE) can decrypt it.

It's industry-leading privacy you can verify. pic.twitter.com/f37CQabhfM

— Brave (@brave) October 15, 2026

November’s Green Label Did Not Seal the Chat

This is the second stage of a pipeline Brave started in Nightly, not a cold start. In the first stage, chats still crossed Brave’s servers under policy: encrypted in transit, not logged, discarded after a reply. Brave’s servers also checked the TEE and showed a green label, so the check itself meant trusting Brave.

FROM NIGHTLY LABEL TO SEALED PROMPTS

1. 2014: Eich’s “Trust but Verify” essay argued that users should be able to check software, not take a vendor’s word, after Ken Thompson’s compiler-backdoor lecture.
2. November 20, 2025: Brave puts DeepSeek V3.1 in NEAR AI Nvidia-backed TEEs on Nightly, with a “Verifiably Private with NEAR AI TEE” label after Brave performs the check.
3. August 26, 2026: Z.ai releases GLM 5.3 Flash with MIT weights, after an anonymous ox-alpha preview.
4. October 15, 2026: end-to-end encrypted Brave AI chat with GLM 5.3 Flash ships in Release, Beta, and Nightly, with the pipeline code public.

Brave had promised two things before a wider rollout: open-source every stage, including the AI Gateway, and move verification closer to the user. This release publishes the code and adds on-device encryption. It does not yet move the attestation check into the browser. Brave also noted that OpenAI announced Private Intelligence in September 2026, with that private inference still to come.

Where the Trust Chain Stops

NEAR AI Cloud also returns an Intel Trust Authority attestation token with the raw evidence, so a check is not only NEAR’s word. Intel Trust Authority is a free attestation service that validates confidential-computing TEEs independent of the cloud operator. That still leaves the CPU vendor, the GPU vendor, and Brave’s oracle in the path.

Illia Polosukhin, co-founder of NEAR, called the production rollout a milestone because browsers hold so much personal information. The practical limit is narrower. Other Leo models, including the open-weight Qwen, DeepSeek, Kimi, Mistral, and Nemotron options Brave already hosts, do not get this sealed path. GLM 5.3 Flash is in beta, and Brave says it will fold more Leo features and more open-weight models into the same mode.

WHAT BRAVE SAYS IS STILL COMING

• Browser-side checks: Move attestation into the browser and publish a log of TEE keys so anyone can confirm every user gets the same one.
• Exact weights: Have the enclave attest to the weights loaded into memory, and check that quantized copies were derived from the original release.
• More of Leo: Bring more features and more open-weight models into verifiably private chats; GLM 5.3 Flash is the only live path.

Brave gave no date for those steps. Anyone who wants the sealed path can pick GLM 5.3 Flash now. Anyone who wants the browser itself to check the chip is still waiting on Brave’s gateway to step out of the way.

Frequently Asked Questions

How Do You Turn On Encrypted Leo Chats?

Open Leo and select GLM 5.3 Flash from the model menu. There is no separate privacy toggle; choosing that model is what puts the chat on the sealed path, and it is live in Release, Beta, and Nightly without a new account.

What Happens If the Enclave Fails Attestation?

Brave will not hand out the encryption key or relay the message. The AI Gateway repeats the check against approved images and signing keys, and it will not forward a prompt if that check is older than an hour or if the live quote no longer matches.

Which Code Repos Prove the Pipeline?

Brave published the client OHTTP files in brave-core, the relay and verifier in the ai-gateway repo (ohttp.py and near.py), and the approval oracle as near-verifier. NEAR AI published inference-proxy, compose-manager, and cloud-api as the code that runs inside the TEEs.

Can You Run GLM 5.3 Flash Without Leo?

Yes. Z.ai put the weights on Hugging Face under MIT, and the model card lists SGLang, vLLM, TokenSpeed, Transformers, KTransformers, and Unsloth for local serving, a path that never touches NEAR AI or Brave’s gateway.

The sealed GLM 5.3 Flash path is the part that is live. The browser-side check, the public TEE-key log, and weight-level attestation are the parts Brave still has to ship.