NEAR AI Brings Hardware Verified Privacy to Brave Leo

NEAR (@NEARProtocol) AI Cloud, linked to the $NEAR ecosystem, now powers private inference for the Leo assistant in the Brave (@brave) browser. Prompts stay encrypted in the browser and are decrypted only inside a hardware enclave, a design intended to keep chat contents out of reach of Brave, the cloud provider and the hosts running the servers.

How the privacy setup works

Brave's engineering team says the browser encrypts each prompt on the user's device using Oblivious HTTP, an IETF standard, so that only an attested Trusted Execution Environment (TEE) can decrypt it and run the model, according to Brave's technical post on the update.

Before a prompt leaves the browser, the TEE must present a hardware-signed attestation. Brave says this is verified to confirm the secure hardware is authentic and that the model and publicly auditable code running inside it have not been altered. A separate verification oracle rebuilds NEAR AI's code from public source to check that the attested enclave matches what is actually running, according to a summary of the announcement on a developer news site.

IP addresses are also shielded. The encrypted prompt is routed through Brave's open-source AI Gateway, which hides the user's IP address from NEAR AI, Brave says. The open-weight GLM 5.3 Flash model runs inside a sealed, Nvidia-backed enclave operated by NEAR AI. Hardware-enforced isolation is meant to protect prompts and responses from infrastructure operators, including Brave and NEAR AI.

Availability and background

Technology press coverage reports that the feature is available in Brave Release, Beta and Nightly, and users need to select GLM 5.3 Flash in Leo to use it.

The update builds on earlier work. In November 2025, Brave began using NEAR AI's Nvidia-backed TEEs for Leo. In that first release, according to Brave, user requests still passed through Brave's servers under existing privacy policies, so those protections rested on policy rather than cryptography. The new design moves more of that assurance into the encryption and attestation layers.

Open weights are central to the approach. Because the model's weights are public, an independent operator such as NEAR AI can host it inside attested hardware without the model's developer, Z.ai, seeing user conversations, and anyone can inspect or benchmark the model the TEE attests to, Brave says.

The privacy claims come from the companies involved, and the design has not been independently audited in the sources reviewed. Coverage of the launch also notes that the system does not yet address training verifiability.

Sources

Leo adds end-to-end encryption, Oblivious HTTP and verifiable confidential computingBrave Leo gets end-to-end encrypted chatBrave Leo locks chats inside hardware