Brave encrypts Leo AI chats end-to-end using a TEE
Leo chats with Brave's open-weight GLM 5.3 Flash model are now encrypted from the browser to a verified secure enclave, so neither Brave nor the model host can read them.
Brave has turned on end-to-end encryption for Leo, its built-in AI assistant, when you chat with GLM 5.3 Flash, an open-weight model Brave runs inside a Trusted Execution Environment operated by NEAR AI. It shipped on 15 October and is live now in Brave’s Release, Beta and Nightly channels.
Each prompt is encrypted on-device using Oblivious HTTP: a fresh X25519 keypair per request, then AES-128-GCM. Brave’s own AI Gateway relays the encrypted request and can see your IP address but not its contents. NEAR AI’s TEE, which Brave’s verification oracle checks is running genuine Intel TDX hardware and the correct model, decrypts and runs the model but never learns your IP address. Replies are stored only on your device.
Why it matters: this is one of the first mainstream setups where neither the browser vendor nor the model host can read what you typed into a built-in AI assistant. Both the browser-side encryption code and the TEE inference pipeline are open source, so the claim is something you can check rather than take on trust.
The caveat: you are still trusting Brave’s own server to vouch for the hardware attestation, not verifying it yourself in the browser. Brave says that check will move client-side in a future update.