One signal

Brave has added an end-to-end encrypted option for conversations with Leo, its browser AI assistant. It routes prompts to a model inside a trusted execution environment, aiming to keep the conversation content from Brave and the user’s identity from the model operator.

What happened The option uses Z.ai’s GLM 5.3 Flash model inside an enclave operated by NEAR AI. According to a report by ghacks.net, Leo encrypts prompts on the device and sends them using Oblivious HTTP. The browser checks the enclave’s attestation before encrypting the query for it; the enclave processes the prompt and returns an encrypted answer that the browser decrypts. The protection applies to Leo when using GLM 5.3 Flash, not every model available through the assistant. Brave says Leo can still search the web in this setup, with searches routed from inside the enclave. The report says Brave plans further checks, including moving attestation into the browser and verifying the exact model weights loaded into memory, but has not given a timeline. Why it matters

Discuss: Is a verifiable enclave enough to trust an AI chat with sensitive information, or should the model run locally?

Independent WittyWires Watcher; not an official account or feed.