Brave Leo Encrypted AI Chat: How Private Prompts Work

Brave has added end-to-end encrypted chat to Leo, the AI assistant built into its browser. Announced on October 15, the feature encrypts your prompts on your own device. They can be decrypted only inside a hardware-protected enclave that has proved what it is running. That includes any web page you share with Leo. It is available now on the Release, Beta and Nightly channels of Brave when you select the open-weight GLM 5.3 Flash model.

• Sealed in the browser: prompts and shared pages are encrypted with Oblivious HTTP (HPKE, RFC 9180), using a fresh key for every request
• Verified enclave: the model runs inside a NEAR AI trusted execution environment on Intel TDX CPUs and Nvidia confidential-computing GPUs
• Identity split from content: Brave's AI Gateway sees your IP address but not your message; the enclave sees your message but not your IP
• No stored chats: Brave says neither it nor NEAR AI keeps conversations, and history stays on your device

How Does Brave Leo's Encrypted Chat Work?

The design follows the oldest rule in security: trust nothing you have not verified. Brave describes four steps.

1. Verify first. A verification service checks each NEAR AI deployment, including Intel and Nvidia hardware attestation, a rebuild of the source code, the model's identity, and keys bound to the enclave. Brave's AI Gateway confirms the enclave's live attestation before it gives your browser an encryption key. If the check fails, no messages are sent.
2. Seal locally. Leo encrypts each prompt with a one-time key. It re-encrypts the full conversation history on every turn, so nothing earlier is left exposed.
3. Split who you are from what you say. The gateway relays the ciphertext under Brave's own account. It knows where a request came from but cannot read it. The enclave can read it but never learns who sent it.
4. Process inside protected memory. Inference happens in hardware-encrypted memory, and replies come back encrypted to your browser.

Private Web Search Inside the Enclave

AI assistants often leak context through the searches they run on your behalf. Brave closes that gap: queries the model generates also originate inside the enclave, so they are never tied to your IP address. They go to the Brave Search API's LLM Context endpoint under a zero-data-retention option and are served from Brave's independent search index.

What Is a Trusted Execution Environment?

A trusted execution environment (TEE) is a locked room inside a processor. Code and data in that room are encrypted in memory, and even the server's operator cannot read them. The chip can produce a signed attestation proving what is running inside. Intel TDX provides that room on the CPU side, and Nvidia's confidential-computing GPUs extend it to the hardware that runs the model, verified through Nvidia's remote attestation service.

As The Register noted in its coverage, the result is privacy that users can check rather than just trust. That is a meaningful shift for AI assistants that read your email drafts, documents and browsing.

What Comes Next for Verifiable AI Privacy

Brave is open about the next steps. Today the browser relies on Brave's gateway to check attestation, so you still trust the gateway's verification. The roadmap moves that check into the browser itself. It also adds a public log of enclave keys and has the enclave attest to the exact model weights it loads, including quantized versions checked against the original release. Brave says GLM 5.3 Flash is in beta, and more models and Leo features will follow.

This builds on Brave's privacy tooling such as free email aliases. It also joins a broader push for private on-device and in-browser AI, like Firefox Smart Window running Mistral Small 4. For more defensive technology stories, see our AI security coverage.

Sources: Brave — End-to-end encrypted AI in the browser — October 15, 2026; The Register — Brave tees up end-to-end encryption for AI chats — October 16, 2026.