--- title: Another Brave User-First AI Win: Leo adds End-to-end... description: Brave's Leo AI assistant now encrypts chats end-to-end using Oblivious HTTP (OHTTP) and runs the open-weight GLM 5.3 Flash model inside Nvidia-backed, attested... canonical: https://daily.dev/posts/another-brave-user-first-ai-win-leo-adds-end-to-end-encryption-oblivious-http-and-verifiable-conf-7cnac7wlx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Another Brave User-First AI Win: Leo adds End-to-end Encryption, Oblivious HTTP, and Verifiable Confidential Computing | daily.dev og:description: Brave's Leo AI assistant now encrypts chats end-to-end using Oblivious HTTP (OHTTP) and runs the open-weight GLM 5.3 Flash model inside Nvidia-backed, attested... og:url: https://daily.dev/posts/another-brave-user-first-ai-win-leo-adds-end-to-end-encryption-oblivious-http-and-verifiable-conf-7cnac7wlx og:image: https://api.daily.dev/og/posts/7CNAc7wlX.png og:image:alt: Another Brave User-First AI Win: Leo adds End-to-end Encryption, Oblivious HTTP, and Verifiable Confidential Computing og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Another Brave User-First AI Win: Leo adds End-to-end Encryption, Oblivious HTTP, and Verifiable Confidential Computing **[Brave](https://daily.dev/sources/brave)** · 21 min read · 0 upvotes · 0 comments ## Summary Brave's Leo AI assistant now encrypts chats end-to-end using Oblivious HTTP (OHTTP) and runs the open-weight GLM 5.3 Flash model inside Nvidia-backed, attested Trusted Execution Environments (TEEs) operated by NEAR AI. Prompts are encrypted on-device before leaving the browser, the Brave AI Gateway strips IP addresses, and an open-source verification oracle rebuilds NEAR AI's code from public source to confirm the attested TEE matches what's actually running. This builds on Brave's November 2025 TEE announcement, aiming to make AI privacy cryptographically verifiable rather than policy-based. The piece details the full architecture (HPKE/X25519/AES-128-GCM under OHTTP, attestation flow, IP separation via relay/gateway split, private web search via Brave's LLM Context API) and cites recent incidents (ChatGPT log subpoenas, leaked chat databases, cookie-based tracking) as motivation. Future plans include moving attestation checks into the browser and verifying model weights directly. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Brave's Leo AI chat implement end-to-end encryption for conversations with the GLM 5.3 Flash model? Brave's browser encrypts each prompt on-device using Oblivious HTTP (OHTTP), an IETF standard built on Hybrid Public Key Encryption (HPKE, RFC 9180), before it leaves the device. A fresh X25519 ephemeral keypair is generated per request, an ECDH exchange with the TEE's public key produces a shared secret, HKDF-SHA256 derives a symmetric key, and the message is encrypted with AES-128-GCM so only the attested Nvidia-backed Trusted Execution Environment running GLM 5.3 Flash can decrypt it. _Developers weighing confidential-computing approaches for AI features can track verified implementations like this one on daily.dev._ ### How does Brave's AI Gateway prevent the TEE operator from linking my IP address to my chat requests? The Brave AI Gateway acts as an OHTTP relay that splits knowledge between two parties: Brave sees the user's IP address but cannot read the encrypted message content, while it forwards the ciphertext to NEAR AI's TEE under Brave's own account so every request appears to originate from Brave rather than an individual user. The TEE decrypts and answers the message but never learns the originating IP address. _Anyone comparing privacy-preserving relay architectures can follow writeups like this through daily.dev._ ### What is GLM 5.3 Flash and why does its open-weight license matter for verifiable AI privacy? GLM 5.3 Flash is an open-weight large language model released by Z.ai under the permissive MIT license in August 2026. Because its weights are public, an independent operator (NEAR AI) can host it entirely inside attested hardware so that Z.ai never sees user conversations, and anyone can download, inspect, or benchmark the exact model that the TEE attests to, unlike closed models that run only under their maker's control. _Developers deciding between open-weight and closed models for privacy-sensitive products can keep up with releases like this via daily.dev._ ## Similar posts on daily.dev - [Verifiable Privacy and Transparency: A new frontier for Brave AI privacy](https://daily.dev/posts/verifiable-privacy-and-transparency-a-new-frontier-for-brave-ai-privacy-ji6xwphsc) · Brave · 0 upvotes · 0 comments - [Brave AI assistant Leo adds Trusted Execution Environments](https://daily.dev/posts/brave-ai-assistant-leo-adds-trusted-execution-environments-jcxed3tmu) · The Register · 0 upvotes · 0 comments --- Tags: [#encryption](https://daily.dev/tags/encryption) [View this post on daily.dev](https://daily.dev/posts/another-brave-user-first-ai-win-leo-adds-end-to-end-encryption-oblivious-http-and-verifiable-conf-7cnac7wlx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Another Brave User-First AI Win: Leo adds End-to-end Encryption, Oblivious HTTP, and Verifiable Confidential Computing","url":"https://daily.dev/posts/another-brave-user-first-ai-win-leo-adds-end-to-end-encryption-oblivious-http-and-verifiable-conf-7cnac7wlx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/another-brave-user-first-ai-win-leo-adds-end-to-end-encryption-oblivious-http-and-verifiable-conf-7cnac7wlx"},"datePublished":"2026-10-15T16:41:23.174Z","dateModified":"2026-10-15T16:50:43.190Z","description":"Brave's Leo AI assistant now encrypts chats end-to-end using Oblivious HTTP (OHTTP) and runs the open-weight GLM 5.3 Flash model inside Nvidia-backed, attested...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c4c88e6752d84b57755681eadc76e54?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c4c88e6752d84b57755681eadc76e54?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Brave","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Brave","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/12f1006df9d246a39d7fba20ab78bcba","url":"https://daily.dev/sources/brave"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/another-brave-user-first-ai-win-leo-adds-end-to-end-encryption-oblivious-http-and-verifiable-conf-7cnac7wlx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"encryption","timeRequired":"PT21M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Brave","item":"https://daily.dev/sources/brave"},{"@type":"ListItem","position":3,"name":"Another Brave User-First AI Win: Leo adds End-to-end Encryption, Oblivious HTTP, and Verifiable Confidential Computing"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/another-brave-user-first-ai-win-leo-adds-end-to-end-encryption-oblivious-http-and-verifiable-conf-7cnac7wlx#faq","mainEntity":[{"@type":"Question","name":"How does Brave's Leo AI chat implement end-to-end encryption for conversations with the GLM 5.3 Flash model?","acceptedAnswer":{"@type":"Answer","text":"Brave's browser encrypts each prompt on-device using Oblivious HTTP (OHTTP), an IETF standard built on Hybrid Public Key Encryption (HPKE, RFC 9180), before it leaves the device. A fresh X25519 ephemeral keypair is generated per request, an ECDH exchange with the TEE's public key produces a shared secret, HKDF-SHA256 derives a symmetric key, and the message is encrypted with AES-128-GCM so only the attested Nvidia-backed Trusted Execution Environment running GLM 5.3 Flash can decrypt it. Developers weighing confidential-computing approaches for AI features can track verified implementations like this one on daily.dev."}},{"@type":"Question","name":"How does Brave's AI Gateway prevent the TEE operator from linking my IP address to my chat requests?","acceptedAnswer":{"@type":"Answer","text":"The Brave AI Gateway acts as an OHTTP relay that splits knowledge between two parties: Brave sees the user's IP address but cannot read the encrypted message content, while it forwards the ciphertext to NEAR AI's TEE under Brave's own account so every request appears to originate from Brave rather than an individual user. The TEE decrypts and answers the message but never learns the originating IP address. Anyone comparing privacy-preserving relay architectures can follow writeups like this through daily.dev."}},{"@type":"Question","name":"What is GLM 5.3 Flash and why does its open-weight license matter for verifiable AI privacy?","acceptedAnswer":{"@type":"Answer","text":"GLM 5.3 Flash is an open-weight large language model released by Z.ai under the permissive MIT license in August 2026. Because its weights are public, an independent operator (NEAR AI) can host it entirely inside attested hardware so that Z.ai never sees user conversations, and anyone can download, inspect, or benchmark the exact model that the TEE attests to, unlike closed models that run only under their maker's control. Developers deciding between open-weight and closed models for privacy-sensitive products can keep up with releases like this via daily.dev."}}]} ```