Want your AI chats to stay private? Brave TEEs up end-to-end encryption

Browser maker using trusted hardware to protect conversations with GLM 5.3 Flash

Brave Software has set up a secure space so those using its browser can converse with the company's AI assistant in private.

At a time when AI agents like Meta's Muse ask for extensive access to personal information, and AI companies repurpose conversations for training, this amounts to swimming against the tide.

Following up on an experiment launched last November to implement a confidential channel for LLM conversations with the help of NEAR AI's trusted execution environment (TEE), the browser maker has connected its Leo AI assistant to Z.ai's GLM 5.3 Flash under the protection of end-to-end encryption.

REG AD

The result is that Brave users can submit a prompt to Leo that gets encrypted on-device and sent over the network using Oblivious HTTP, a protocol for separating network requests from associated content. Brave's AI Gateway forwards the encrypted query to the TEE without passing along the user's IP address.

REG AD

After Brave verifies the enclave's attestation, the browser encrypts the query using a key bound to the TEE. The TEE decrypts the request, runs it through the AI model, and sends back an encrypted response that gets decrypted by the receiving browser.

"In 2014, I argued in 'Trust but Verify' that users shouldn't have to place blind trust in the software they rely on," said Brendan Eich, co-founder and CEO of Brave, in a statement. "They should be able to verify it; this is a user-first principle. AI has raised the stakes, yet too much of it still runs on 'trust me bro' promises, often at the user's expense."

NEAR AI's confidential AI pipeline is built with Intel TDX and Nvidia Confidential Compute. It includes end-to-end encryption that keeps Brave from knowing what was asked and NEAR AI from knowing who did the asking during the network hop. Data isolation prevents the prompt or response from being read during processing. Responses are signed in the TEE and there's attestation so users can confirm there's no model bait-and-switch.

Leo's GLM 5.3 Flash brain may be isolated in this scenario, but Brave's AI bot can still conduct searches from within the TEE via the Brave Search API's LLM context endpoint. And any searches done this way transit via the TEE rather than the user's browser, which keeps the user's IP address out of the picture.

The implementation isn't quite complete: Brave intends to work on moving the verification step into the browser and to publish a log of TEE keys, and to provide enclave attestation for exact model weights loaded into memory, among other things.

Brave is not the only company trying to make AI less of a data exposure risk. Apple, AWS, Google, Nvidia, and Microsoft all have some form of private cloud compute infrastructure for AI. 

Then there's Prem AI, which promises encrypted inference, not to mention providers advertising zero data retention, which isn't as verifiable.

One way to ensure privacy while using AI is to run inference on local hardware using an open weight model, assuming the model and the machine running it haven't been compromised. ®