Brave has added end-to-end encryption for conversations with GLM 5.3 Flash in Leo, its browser’s AI assistant, with hardware protections that the company says prevent infrastructure operators from reading chats. The feature is available across Brave’s Release, Beta and Nightly versions. Brave says prompts are encrypted on the user’s device before transmission and can be decrypted only inside a verified Trusted Execution Environment, or TEE.
The protections apply to conversations using the open-weight GLM model; Brave also offers other models in Leo. NEAR AI operates the Nvidia-backed hardware enclave where GLM 5.3 Flash processes those conversations. According to Brave, hardware isolation shields both questions and answers from the companies operating the infrastructure, including Brave and NEAR AI themselves.
Before sending a prompt, the browser checks a hardware-signed attestation from the TEE. That check verifies the secure hardware’s authenticity, along with the integrity of the model and the publicly inspectable code executing inside it. Brave says this also lets users verify that the model answering their questions is the one they selected, rather than a cheaper replacement.
The browser uses Oblivious HTTP, or OHTTP, to encrypt prompts before sending them through Brave’s AI Gateway. That open-source relay conceals the user’s IP address from NEAR AI, the AI provider handling the request. The private key needed to decrypt the conversation remains inside the TEE, according to Brave, restricting access to the environment that passed verification.
Brave says conversation history remains on the user’s device and that neither it nor NEAR AI retains a readable version of the chats. The company also says the model’s creator cannot see what users write. Those are the basis for Brave’s claim that the operators have no readable conversation data to use for training, disclose to others or expose in a leak.
For outside scrutiny, Brave makes public the model weights and the software behind the protocol, relay and verifier, along with NEAR AI’s code for the TEE. Its verification oracle rebuilds NEAR AI’s software using the public source and checks whether the result matches the code running inside the protected environment. Brave says the browser receives the encryption key only after that verification succeeds.
