Want your AI chats to stay private? Brave TEEs up end-to-end encryption

Brave Software has set up a secure space so those using its browser can converse with the company's AI assistant in private.

At a time when AI agents like Meta's Muse ask for extensive access to personal information, and AI companies repurpose conversations for training, this amounts to swimming against the tide.

Following up on an experiment launched last November to implement a confidential channel for LLM conversations with the help of NEAR AI's trusted execution environment (TEE), the browser maker has connected its Leo AI assistant to Z.ai's GLM 5.3 Flash under the protection of end-to-end encryption.

The result is that Brave users can submit a prompt to Leo that gets encrypted on-device and sent over the network using Oblivious HTTP, a protocol for separating network requests from associated content.

Brave's AI Gateway forwards the encrypted query to the TEE without passing along the user's IP address.

After Brave verifies the enclave's attestation, the browser encrypts the query using a key bound to the TEE.

The TEE decrypts the request, runs it through the AI model, and sends back an encrypted response that gets decrypted by the receiving browser.

"In 2014, I argued in 'Trust but Verify' that users shouldn't have to place blind trust in the software they rely on," said Brendan Eich, co-founder and CEO of Brave, in a statement.

"They should be able to verify it; this is a user-first principle.

AI has raised the stakes, yet too much of it still runs on 'trust me bro' promises, often at the user's expense." NEAR AI's confidential AI pipeline is built with Intel TDX and Nvidia Confidential Compute.

It includes end-to-end encryption that keeps Brave from knowing what was asked and NEAR AI from knowing who did the asking during the network hop.

Data isolation prevents the prompt or response from being read during processing.

Responses are signed in the TEE and there's attestation so users can confirm there's no model bait-and-switch.

Leo's GLM 5.3 Flash brain may be isolated in this scenario, but Brave's AI bot can still conduct searches from within the TEE via the Brave Search API's LLM context endpoint.