Modern AI assistants have rapidly evolved into primary confidants for millions of users, routinely processing deeply sensitive information ranging from flagged medical portal results and debt management queries to confidential corporate plans and draft legal agreements.
Yet, under traditional AI deployments, every conversation and attached webpage is transmitted to third-party servers in plaintext.
This architectural design leaves user data vulnerable to automatic model training, broad legal subpoenas, open-database leaks, accidental search engine indexing, and silent server-side model substitutions.
Addressing these persistent vulnerabilities, Brave has upgraded its built-in browser assistant, Leo, by integrating end-to-end encryption, Oblivious HTTP routing, and verifiable confidential computing.
The technical design replaces verbal privacy guarantees with hardware-enforced cryptographic boundaries.
When a user submits a query to the open-weight GLM model in Leo, the Brave browser encrypts the prompt on the client device prior to network transmission. To prevent network-level identity tracking, the encrypted payload is routed through Oblivious HTTP via Brave’s open-source AI Gateway.
It is this relay mechanism that strips the user's IP address and decouples network metadata from the underlying payload, ensuring that neither Brave nor the infrastructure provider, NEAR AI, can correlate incoming queries with specific network addresses or individual user accounts.
Decryption and model execution take place strictly within a sealed, Nvidia-backed Trusted Execution Environment operated by NEAR AI.
Before the client browser transfers the encryption key required to unlock the prompt, the enclave must produce a hardware-signed attestation.
This cryptographic proof verifies both the physical authenticity of the secure hardware enclave and the exact hash of the publicly auditable code running inside it.
Through this verifiable process, the host machine, infrastructure operators, model developers, and Brave itself are mathematically prevented from intercepting plaintext chats, capturing conversation logs, or extracting data for future model training.
By combining open-weight architecture with open-source client code, OHTTP anonymization relays, and hardware-backed attestation, the system ensures that user chats remain completely unreadable to outside entities.
Rolling out across Brave Release, Beta, and Nightly channels, this update establishes a verifiable security model for browser-integrated artificial intelligence, keeping private prompts isolated and cryptographically secure throughout their entire lifecycle.
Long story short, Brave's approach with Leo separates the party that sees the IP address from the party that sees the text, and it confines processing to hardware that the operator of the cloud servers cannot inspect.
Users still choose the model and can switch back to other options in Leo that do not use this path.
The company described the release as a step that lets the claims about privacy be checked against the published code and the hardware proofs rather than accepted on policy alone.
