• Home
• Technology

Brave Software has introduced a confidential computing environment designed to protect conversations between users of its browser and the Leo AI assistant, using end-to-end encryption and trusted execution environments to limit exposure of personal data.

The move comes as concerns grow over AI agents seeking extensive access to personal information and companies reusing chatbot conversations to train models. Brave's approach aims to make AI processing more verifiable rather than relying solely on users' trust in service providers.

The implementation builds on an experiment launched in November 2025 with NEAR AI, which explored confidential channels for large language model conversations using trusted execution environments (TEEs). Brave has now connected Leo to Z.ai's GLM 5.3 Flash model under end-to-end encryption.

How the privacy system works

A user's prompt is encrypted on the device before being transmitted through Oblivious HTTP, a protocol that separates network requests from their associated content. Brave's AI Gateway forwards the encrypted query to the TEE without passing along the user's IP address.

After verifying the enclave's attestation, the browser encrypts the query using a key bound to the TEE. The environment decrypts the request, runs it through the AI model and returns an encrypted response for the browser to decrypt.

Brave co-founder and CEO Brendan Eich said users should be able to verify the software they rely on rather than place blind trust in it. He argued that AI has made this principle increasingly important, while too many services still depend on assurances that users cannot independently verify.

NEAR AI's confidential AI pipeline uses Intel TDX and Nvidia Confidential Compute. Its safeguards are designed to prevent Brave from accessing prompt contents while keeping NEAR AI from identifying the user during network transmission. Data isolation also protects prompts and responses during processing.

Responses are signed inside the TEE, while attestation mechanisms allow users to check that the intended model is running rather than a substituted alternative.

Search capabilities and planned improvements

Leo can still perform searches through the large-language-model context endpoint of the Brave Search API. These requests pass through the TEE rather than the user's browser, keeping the user's IP address out of the search process.

Brave plans to move verification into the browser, publish a log of TEE keys and introduce attestation covering the exact model weights loaded into memory, alongside other improvements.

Brave is not alone in pursuing confidential AI infrastructure. Apple, AWS, Google, Nvidia and Microsoft all offer forms of confidential computing for AI workloads. Prem AI also promotes encrypted inference, while other providers advertise zero data retention, a promise that is not necessarily as independently verifiable.

Running inference locally on a device with an open-weight model remains another option for limiting data exposure, provided neither the model nor the machine running it has been compromised.