Brave introduced a new system of protection of correspondence with AI-assistant Leo, which, according to the developers, does not allow even the company to read user requests. Messages are encrypted directly in the browser, and the neural network processes them inside the hardware-protected environment.
The new architecture is available to users of the stable, beta and Nightly browser Brave. For secure communication, you need to choose the GLM 5.3 Flash model developed by the Chinese company Z.ai. The mode has the status of beta version, and support for other models and additional functions of the assistant will appear later.
The main difference from conventional cloud chatbots is who gets access to the contents of the correspondence. According to Brave, neither the browser operator, nor the NEAR AI computing power provider, nor the owner of cloud servers can read user messages. The neural network receives open text only inside an isolated computing environment protected by hardware mechanisms.
Before submitting the request, the browser receives a cryptographic key associated with the trusted TEE (Trusted Execution Environment) execution environment. This environment insulates calculations and memory from the rest of the system, including server administrator software. First, the special mechanism checks the authenticity of the equipment and the running program code, after which it allows you to use the key for encryption.
To transmit messages, Brave uses the Oblivious HTTP (OHTTP) protocol, which shares the sender’s network address and the request content. The browser encrypts the text and sends it through the Brave AI Gateway intermediate gateway. The gateway sees the user's IP address but cannot decrypt the message. Before sending to NEAR AI, the system removes the original IP address, so the computing infrastructure does not receive a direct network ID of the interlocutor.
After delivering the encrypted message, the secure environment decrypts the request and transmits it to GLM 5.3 Flash models. The answer is encrypted within the same environment and returned to the browser, where the user receives the usual text. With each new address, the browser creates a temporary pair of cryptographic keys and re-encrypts the entire history of the dialogue, the necessary model to continue the conversation.
The mechanism is based on Hybrid Public Key Encryption (HPKE), standardized in RFC 9180. The X25519 algorithm is used to reconcile the general secret, HKDF-SHA256 is used to obtain a symmetric key, and the contents of the request protects AES-128-GCM. The last mechanism allows not only to hide correspondence from outsiders, but also to detect an attempt to inconspicuously change the encrypted data during transmission.
The computing infrastructure combines Intel Trust Domain Extensions (TDX) and Nvidia Confidential Computing. Intel processors insulate the memory of the virtual machine from the host system administrator, and the secure Nvidia graphics accelerators perform the calculations of the neural network without the operator's usual access to the processed data. The transmission of information between processors and video accelerators is also protected by encryption.
A separate certification mechanism is responsible for the verification of the trusted environment. The system checks Intel and Nvidia hardware evidence, maps the running code with the verified sources and takes into account information about the software builds. The developers have published infrastructure components so that independent professionals can study the implementation of cryptographic protection and verification procedures.
Protected mode keeps the ability to search for information on the Internet. GLM 5.3 Flash accesses Brave Search API directly from the trusted environment and receives relevant web page snippets through the LLM Context interface. According to Brave, the source text of the conversation is not disclosed with such a search, and search queries are sent from the computing server, and not from the IP address of the user.
Brave also claims that it does not store correspondence on its own servers or in the NEAR AI infrastructure. The history of conversations remains on the user's device. No account is required to access Leo, and paid subscriptions are checked with tokens that do not have to link payment information to the contents of the dialogs.
However, the developers have not yet completed the entire system of independent verification. Now the hardware certification is performed by the Brave infrastructure, not directly the user's browser. In the future, the company intends to transfer the check to the client device and publish the journal of cryptographic keys of trusted environments. This mechanism will make sure that different users are provided with the same verified keys.
There is another question. The current certification confirms the authenticity of the equipment and the proven software environment, but does not yet prove cryptographically which weights of the neural network are loaded into memory. Brave plans to add a model weight check, including matching optimized versions of the original GLM 5.3 Flash. Until the completion of the work, it is impossible to completely exclude the inconspicuous substitution of the model by means of a new architecture.
Protection also depends on the safety of processors, video accelerators and certification mechanisms. A study by TEE.fail, published in October 2025, showed the possibility of attacks on hardware-insulated environments of Intel, AMD and Nvidia with physical access to equipment and additional conditions. The results do not prove the vulnerability of Brave implementation, but remind you that hardware insulation does not guarantee absolute security.
Brave began experimenting with sensitive computing for Leo back in November 2025. The current launch expands the original architecture with full end-to-end encryption, the separation of network IDs and query contents, and the publication of code for independent audit. For cloud-based AI services, this approach changes the usual model of trust, as the operator no longer needs to provide the technical ability to read user dialogues.
Similar ways to protect cloud computing develop Apple, Google, Microsoft, Amazon and Nvidia. However, the Brave implementation combines hardware insulation, open weights of the neural network and encryption of queries directly in the browser. So far, the possibilities are limited by a specific model, and some of the inspections have yet to be implemented. Therefore, the statement about the inaccessibility of correspondence even for Brave itself relies on the declared architecture and operation of trusted equipment, and not on the already completed independent inspection of all components.
The new architecture is available to users of the stable, beta and Nightly browser Brave. For secure communication, you need to choose the GLM 5.3 Flash model developed by the Chinese company Z.ai. The mode has the status of beta version, and support for other models and additional functions of the assistant will appear later.
The main difference from conventional cloud chatbots is who gets access to the contents of the correspondence. According to Brave, neither the browser operator, nor the NEAR AI computing power provider, nor the owner of cloud servers can read user messages. The neural network receives open text only inside an isolated computing environment protected by hardware mechanisms.
Before submitting the request, the browser receives a cryptographic key associated with the trusted TEE (Trusted Execution Environment) execution environment. This environment insulates calculations and memory from the rest of the system, including server administrator software. First, the special mechanism checks the authenticity of the equipment and the running program code, after which it allows you to use the key for encryption.
To transmit messages, Brave uses the Oblivious HTTP (OHTTP) protocol, which shares the sender’s network address and the request content. The browser encrypts the text and sends it through the Brave AI Gateway intermediate gateway. The gateway sees the user's IP address but cannot decrypt the message. Before sending to NEAR AI, the system removes the original IP address, so the computing infrastructure does not receive a direct network ID of the interlocutor.
After delivering the encrypted message, the secure environment decrypts the request and transmits it to GLM 5.3 Flash models. The answer is encrypted within the same environment and returned to the browser, where the user receives the usual text. With each new address, the browser creates a temporary pair of cryptographic keys and re-encrypts the entire history of the dialogue, the necessary model to continue the conversation.
The mechanism is based on Hybrid Public Key Encryption (HPKE), standardized in RFC 9180. The X25519 algorithm is used to reconcile the general secret, HKDF-SHA256 is used to obtain a symmetric key, and the contents of the request protects AES-128-GCM. The last mechanism allows not only to hide correspondence from outsiders, but also to detect an attempt to inconspicuously change the encrypted data during transmission.
The computing infrastructure combines Intel Trust Domain Extensions (TDX) and Nvidia Confidential Computing. Intel processors insulate the memory of the virtual machine from the host system administrator, and the secure Nvidia graphics accelerators perform the calculations of the neural network without the operator's usual access to the processed data. The transmission of information between processors and video accelerators is also protected by encryption.
A separate certification mechanism is responsible for the verification of the trusted environment. The system checks Intel and Nvidia hardware evidence, maps the running code with the verified sources and takes into account information about the software builds. The developers have published infrastructure components so that independent professionals can study the implementation of cryptographic protection and verification procedures.
Protected mode keeps the ability to search for information on the Internet. GLM 5.3 Flash accesses Brave Search API directly from the trusted environment and receives relevant web page snippets through the LLM Context interface. According to Brave, the source text of the conversation is not disclosed with such a search, and search queries are sent from the computing server, and not from the IP address of the user.
Brave also claims that it does not store correspondence on its own servers or in the NEAR AI infrastructure. The history of conversations remains on the user's device. No account is required to access Leo, and paid subscriptions are checked with tokens that do not have to link payment information to the contents of the dialogs.
However, the developers have not yet completed the entire system of independent verification. Now the hardware certification is performed by the Brave infrastructure, not directly the user's browser. In the future, the company intends to transfer the check to the client device and publish the journal of cryptographic keys of trusted environments. This mechanism will make sure that different users are provided with the same verified keys.
There is another question. The current certification confirms the authenticity of the equipment and the proven software environment, but does not yet prove cryptographically which weights of the neural network are loaded into memory. Brave plans to add a model weight check, including matching optimized versions of the original GLM 5.3 Flash. Until the completion of the work, it is impossible to completely exclude the inconspicuous substitution of the model by means of a new architecture.
Protection also depends on the safety of processors, video accelerators and certification mechanisms. A study by TEE.fail, published in October 2025, showed the possibility of attacks on hardware-insulated environments of Intel, AMD and Nvidia with physical access to equipment and additional conditions. The results do not prove the vulnerability of Brave implementation, but remind you that hardware insulation does not guarantee absolute security.
Brave began experimenting with sensitive computing for Leo back in November 2025. The current launch expands the original architecture with full end-to-end encryption, the separation of network IDs and query contents, and the publication of code for independent audit. For cloud-based AI services, this approach changes the usual model of trust, as the operator no longer needs to provide the technical ability to read user dialogues.
Similar ways to protect cloud computing develop Apple, Google, Microsoft, Amazon and Nvidia. However, the Brave implementation combines hardware insulation, open weights of the neural network and encryption of queries directly in the browser. So far, the possibilities are limited by a specific model, and some of the inspections have yet to be implemented. Therefore, the statement about the inaccessibility of correspondence even for Brave itself relies on the declared architecture and operation of trusted equipment, and not on the already completed independent inspection of all components.
