Brave has added end-to-end encryption and hardware-backed confidential computing to its Leo browser assistant, protecting conversations with the GLM 5.3 Flash model from access by the companies handling them.
Announced yesterday, the update uses Oblivious HTTP (OHTTP) to encrypt prompts before they leave the browser, with decryption restricted to verified trusted execution environments (TEEs) operated by NEAR AI. It is available across Brave’s Release, Beta, and Nightly channels.
The rollout builds on Brave’s November 2025 introduction of confidential computing in Leo. That implementation processed requests inside protected hardware, but prompts passed through Brave’s servers under policy-based safeguards. The new architecture encrypts those requests on the user’s device.
Brave, which NEAR AI says serves more than 128 million monthly active users, bundles Leo into its browser. The assistant can answer questions and process content users share from webpages, making its handling of sensitive information particularly consequential.
Separating identity from chat content
Under the updated system, Leo encrypts each request, including conversation history and any shared page content, to a key held inside the protected environment. Responses are encrypted back to the browser, and each conversation turn uses a fresh encryption exchange.
Brave’s AI Gateway relays the encrypted traffic and removes the user’s IP address before forwarding it to NEAR AI. This separates the party that sees the originating IP address from the protected environment that reads the prompt.
According to Brave, its relay cannot read the conversation, while NEAR AI’s infrastructure receives requests under Brave’s account without learning the user’s IP address. Leo also retains its existing protections, including no required login, no IP logging, and conversation history stored locally rather than in the cloud.
Processing runs on Intel TDX CPUs and Nvidia confidential-computing GPUs, with hardware isolation designed to prevent infrastructure operators from accessing prompts and responses during inference.
The model can also generate web searches inside the TEE through Brave Search’s LLM Context endpoint. Those search queries leave the enclave for Brave Search, but are not associated with the user’s IP address and use its zero-data-retention option.
Verification still depends on Brave
Before supplying an encryption key, Brave checks hardware attestation evidence, approved software builds, and the key’s connection to the verified environment. Its verification system also rebuilds NEAR-authored software images from public source to check that they match the deployed versions.
There are limits to that verification. The third-party model runtime is pinned through a hardware-attested deployment log rather than rebuilt from source. More significantly, the browser currently trusts Brave’s gateway to perform the attestation checks.
Brave plans to move verification into the browser, first by checking signed approvals and later by directly verifying hardware attestation.
The protections announced here apply specifically to GLM 5.3 Flash, an open-weight model released under the MIT license, rather than every model offered in Leo. Users can enable them by opening Leo’s model settings and selecting GLM 5.3 Flash.
Leave a Reply