Google said on 23 September 2026 that it will add a persistent, per-user memory layer to Private AI Compute, which until now erased context when each task ended. The platform processes AI requests in hardware-isolated cloud environments. Google says the keys that unlock the memory will be held only on users' devices. It says a secure enclave, one such isolated environment, will decrypt the memory temporarily to handle a request.[1]
According to the updated technical brief, the memory store is a per-user database inside a trusted execution environment (TEE). The brief says keys are released only to an enclave whose attestation matches an endorsed memory binary. An attestation is a signed record of the software an enclave loaded. Google says the memory server and its runtime are open source. It says reproducible builds and an append-only ledger of binary digests tie that code to the deployed binaries. Because each request must reach a specific user's store, the brief says the memory system does not claim network-level non-targetability, the property that requests cannot be linked to users.[2]
Google's post says devices will be able to verify its server software before sending personal data.[1] The brief lists device-side validation of attestation evidence as future work, along with a ledger co-signed by independent third parties. It gives no dates.[2]
A Trail of Bits assessment dated 21 September 2026, linked from the brief, reported ten findings. Google resolved eight, and two remain unresolved. The unresolved finding rated high is that hashes of model-response text are sent outside the trusted computing base, the components that the system's security depends on. The hashes are sent out for checks on whether responses recite copyrighted text. Google plans a filter inside the enclave so that most hashes never leave it. Trail of Bits says this reduces the risk without eliminating it. The other unresolved finding, rated low, is that deleted memories may be restored into the active database. Google accepted that risk. Trail of Bits also noted that Google can change the system without prior external review and that the system contains extensive closed-source code.[3]
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
ac3bb1b44d7e750617b7029ebbf802858ad48822f851f9e61dc3a13a29d66bd0
