Brave said on 15 October 2026 that chats in Leo, its browser's AI assistant, are now end-to-end encrypted in Brave's Release, Beta and Nightly channels when users choose GLM 5.3 Flash, an open-weight model from Z.ai that NEAR AI hosts.[1, 2]

The browser encrypts each request with Oblivious HTTP (OHTTP) for NEAR AI's trusted execution environments (TEEs), hardware-isolated areas designed to shield code and data from the machine's operator. Brave says only the TEEs hold the decryption key. The TEEs run on Intel Trust Domain Extensions (TDX) and NVIDIA confidential-computing graphics processing units (GPUs). Brave says its AI Gateway strips users' Internet Protocol (IP) addresses and gives the browser the TEE's public key only after checking the TEE's current attestation against a verification oracle's approvals.[1]

Before approving a deployment, Brave says, the oracle checks Intel's signature on the TDX quote (the processor's signed attestation report) and the GPUs through NVIDIA's Remote Attestation Service. It checks signed build records for NEAR AI's own images, rebuilds them from the source Brave reviewed and compares the results with the deployed images. The third-party model runtime is not rebuilt; a hardware-attested deployment log pins it and records the model image.[1] Brave publishes the oracle's code as near-verifier, whose README says anyone with a NEAR AI API key can run it against the live service.[1, 3]

The README adds that the oracle does not rebuild NEAR AI's compose-manager-launcher image, pins the weights' Hugging Face revision without hashing the downloaded files and cannot establish which GPU served a request.[3] Brave plans, without giving dates, to move the gateway's check into the browser, publish a log of TEE keys so anyone can confirm all users get the same one, and have the TEEs attest to the weights they load. It says its checks still rest on Intel, NVIDIA, Sigstore, GitHub, Hugging Face, the public Domain Name System and dstack, the TEEs' operating system.[1]

Sources

  1. Another Brave User-First AI Win: Leo adds End-to-end Encryption, Oblivious HTTP, and Verifiable Confidential ComputingBrave · 15 Oct 2026
  2. NEAR AI Cloud Brings Private Inference to Brave LeoNEAR AI · 15 Oct 2026
  3. near-tee-verifier (brave/near-verifier README)Brave on GitHub · accessed 25 Oct 2026

Check or correct this page

Correct
Request a correction · Edit the source on GitHub · Corrections policy
Verification record

The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.

2be9e85f79806717861295b1de77ff8014b74097d490ac9fc906c5f033d101e6

View source · Manifest