Brave Software has connected the Leo AI assistant in its browser to Z.ai's GLM 5.3 Flash model with end-to-end encryption, running the model inside a trusted execution environment (TEE) operated by NEAR AI.

The company says the setup keeps the content of AI conversations hidden from Brave and the identity of the person asking hidden from NEAR AI. The launch follows an experiment Brave started in November 2025 to create a confidential channel for AI conversations in Leo using NEAR AI's TEE.

A prompt sent to Leo in this mode is encrypted on the device and sent over the network with Oblivious HTTP, a protocol that separates network requests from their content. Brave's AI Gateway then forwards the encrypted query to the TEE without passing along the user's IP address.

Before sending anything, the browser verifies the enclave's attestation and encrypts the query with a key bound to the TEE. The enclave decrypts the request, runs it through GLM 5.3 Flash, and returns an encrypted answer that only the receiving browser can decrypt.

NEAR AI's confidential pipeline is built on Intel TDX and Nvidia Confidential Compute. Data isolation prevents the prompt or the response from being read during processing, and responses are signed inside the TEE. Attestation lets users confirm that the model has not been swapped for a different one.

Leo can still run web searches in this setup. Those searches go through the Brave Search API's LLM context endpoint from inside the TEE, not from the user's browser, which keeps the user's IP address out of the request.

"AI has raised the stakes, yet too much of it still runs on 'trust me bro' promises, often at the user's expense," Brave co-founder and CEO Brendan Eich said in a statement published by NEAR AI.

AI agents such as Meta's Muse ask for extensive access to personal information, and some AI companies repurpose conversations for model training. The Brave approach is meant to make the privacy claim verifiable through attestation instead of relying on a provider's zero data retention promise.

Apple, AWS, Google, Nvidia, and Microsoft all operate some form of private cloud compute for AI. Running an open weight model on local hardware remains another way to keep prompts off third-party servers.

Brave users who want this protection need to use Leo with the GLM 5.3 Flash model, since the end-to-end encrypted path covers that model inside the NEAR AI enclave.

The implementation is not complete. Brave plans to move the attestation check into the browser itself, publish a log of TEE keys, and provide enclave attestation for the exact model weights loaded into memory, and the company has not given a timeline for those steps.