Brave Leo adds encrypted AI chats with verifiable computing

Brave has added end-to-end encryption, Oblivious HTTP (OHTTP), and verifiable confidential computing to Leo, its built-in AI assistant. Available in Brave Release, Beta, and Nightly, the new protections initially support Z.ai's open-weight GLM 5.3 Flash model. Compared with its November 2025 integration with NEAR AI, Leo now encrypts conversations directly in the browser before they leave the device, with requests decrypted and processed only inside verified Trusted Execution Environments (TEEs) using Intel TDX and Nvidia confidential computing GPUs.

Before forwarding requests, Brave's gateway verifies hardware attestations, approved software, and model identity. A verification system also rebuilds publicly available source code to confirm it matches deployed software, blocking requests if verification fails. Once verified, OHTTP encrypts each conversation turn and its chat history using temporary encryption keys, while responses are encrypted for local decryption. The gateway separates users' IP addresses from conversation contents, and the AI can perform private web searches directly inside the TEE through Brave Search's LLM Context endpoint. Conversation histories remain stored locally, with neither Brave nor NEAR AI retaining chats on their servers.

Leo continues to work without an account, while Premium subscriptions use unlinkable tokens to separate payment details from conversations. Brave has also published the source code for the privacy pipeline, although verification still depends on external hardware and infrastructure providers. The company plans to introduce direct browser-side verification in future updates.