Brave Leo adds end-to-end encrypted AI chat: GLM 5.3 Flash runs in attested NEAR AI enclaves, prompts sealed in the browser with Oblivious HTTP, now in all release channels

Why it matters

【Key points】

On October 15 Brave said that chats in Leo, its built-in browser assistant, are now end-to-end encrypted when users pick Z.ai's open-weight GLM 5.3 Flash, available in Release, Beta and Nightly (the model is still marked beta in Leo). It works in four steps:

1. The model runs in NEAR AI-operated trusted execution environments on Intel TDX and NVIDIA confidential-computing GPUs. Brave's verifier checks hardware attestation and rebuilds NEAR's images from public source to confirm they match before the browser gets an encryption key.

2. The browser seals each prompt and any shared page locally with the IETF standard Oblivious HTTP.

3. Brave's gateway relays only ciphertext and strips the user's IP: Brave sees the IP but not the content; NEAR AI sees content only inside the TEE but not who sent it.

4. Web search is called from inside the TEE via the Brave Search API, also never in the clear.

History stays on the device; the client, gateway, verifier and in-TEE code are open source. For now attestation is checked at Brave's gateway; Brave plans to move it into the browser and have the TEE attest to the exact weights loaded.

【Verifiable】

Brave blog: https://brave.com/blog/browser-ai-e2ee/

NEAR AI: https://near.ai/blog/near-ai-cloud-brings-private-inference-to-brave-leo

@brave: https://x.com/brave/status/2110773229686280376

【Our read】

1. A rare case of verifiable privacy shipped at scale (NEAR cites 128M+ monthly Brave users), and open weights are what make it possible: only a public model can be run by a third party in attested hardware.

2. The trust chain still ends at Intel and NVIDIA attestation and Brave's gateway; Brave admits in-browser checks are not done yet.

3. The trade-off is a single mid-size open model: Brave chose privacy over capability.