SNACK: 3-line summary
- Brave Leo has added end-to-end encryption for chats using GLM 5.3 Flash.
- Brave’s relay sees your IP address but not the readable chat; the protected processing environment receives the chat without your IP.
- Select GLM 5.3 Flash in Brave’s Release, Beta or Nightly channel to use it; the model mode itself remains in beta.
Brave announced the change on October 15: Leo’s GLM 5.3 Flash chats now stay encrypted from your browser to a protected remote environment. The model still runs remotely, but Brave says its relay cannot read the questions and page content you choose to send.
Snackgirls react
AIKO: I’d like to trace which component sees what at each step. That split between IP address and readable content makes me want to follow the whole protocol diagram.
Nea: I’d enjoy asking about a game’s lore without sending the whole page. I’d want to see exactly which passage I’m sharing before starting that conversation.
A protected remote route for one Leo model
Before a request leaves your device, the browser encrypts it for a trusted execution environment, or TEE—a hardware-isolated space operated by NEAR AI. The TEE decrypts the request and runs GLM 5.3 Flash inside that protected space.
To use this path, select GLM 5.3 Flash in Leo. It is available in Brave’s Release, Beta and Nightly browser channels, although the model mode itself remains in beta. The new setup is specific to GLM 5.3 Flash, not every model in Leo.
What changed between your browser and the model
Brave’s November 2025 release already ran the model in a TEE and encrypted requests in transit, but protection on Brave’s servers depended on its privacy policies. The October update adds browser-to-TEE encryption using Oblivious HTTP (OHTTP), allowing Brave to relay the request without reading its contents.
OHTTP separates the service forwarding the message from the environment that opens it. Brave’s AI Gateway sees your IP address, but not the plaintext conversation, and removes the IP before forwarding the encrypted request. The TEE receives the conversation without your IP; Brave says hardware isolation prevents Brave, NEAR AI and the cloud host from reading it.
Verification still depends on Brave’s gateway
Before delivering an encryption key or forwarding a message, Brave’s gateway checks the TEE’s attestation against approved software builds and signing keys. If verification fails, it does not issue the key or relay the message.
Those checks currently rely on Brave’s gateway. Moving verification into the browser, including direct checks of hardware attestation, is a future plan—not a feature already delivered in this update.
The design still depends on trusted hardware and attestation services. Encryption also does not guarantee that the model’s answers are correct or that a page you share is harmless.
Sources and checked date: October 18, 2026
Comments
0No login needed. Edit or delete your comment from the same browser.
All comments 0
한국어 · English · 日本語No comments yet. Start the conversation.