Brave Leo locks chats inside hardware

Brave says its browser assistant Leo now keeps chats readable only inside verified hardware.

The update applies to chats with the open-weight GLM 5.3 Flash model in Brave Release, Beta and Nightly, routed through Brave's AI Gateway to Nvidia-backed enclaves operated by NEAR AI.

End-to-end encryption is a method where only the endpoints hold the decryption keys so intermediaries cannot read the content.

Oblivious HTTP is a relay protocol that separates who you are from what you sent by encrypting the payload on device and stripping network identifiers at the proxy.

A Trusted Execution Environment is a hardware-isolated enclave where code and data remain encrypted even from the machine operator.

Confidential computing is the practice of running workloads inside that enclave so the host cannot inspect them.

Attestation is a hardware-signed proof that the enclave runs the expected public code and model before the browser releases a key.

Brave says the flow before that was policy based after its November 2025 milestone that put models in TEEs but still decrypted prompts on Brave servers and relied on Brave to check attestation.

The new flow verified in the browser encrypts each prompt with Oblivious HTTP before it leaves the device, sends it via the open-source gateway that hides the IP from NEAR AI, and decrypts only inside the attested enclave that runs GLM 5.3 Flash.

Leo launched in fall 2023 with Llama 2 as the free default, later switched to Mixtral, and now lists hosted open-weight options including Qwen, DeepSeek, Kimi, Mistral and Nemotron before adding GLM 5.3 Flash.

GLM 5.3 Flash is a native multimodal model from Z.ai with a 1,048,576 token context window and listed pricing of $0.036 per million input tokens and $0.90 per million output tokens, per OpenRouter.

Brave pairs open weights with open code and a verification oracle that rebuilds NEAR AI's enclave image from public source to match the attested measurement, addressing the gap where source alone cannot prove what runs.

An attacker would need to break the Nvidia hardware root of trust or steal the enclave private key that never leaves silicon, not just compromise a server or intercept traffic, and there is no remote decryption path without a valid attestation.

The design does not yet cover training verifiability, and Brave notes open training still has a reproducibility problem that projects like Gensyn's open-1b and Brave Research's Confidential-DP proof aim to close.

Watch whether other assistants adopt browser-verified attestation and key release, and whether Brave extends the same guarantees beyond GLM 5.3 Flash to its other hosted models.