NEAR AI Cloud is now powering private AI inference for Brave Leo, the AI assistant built into the Brave browser. Announced on October 15, 2026, the integration allows users who select GLM 5.3 Flash to process conversations inside hardware-protected environments designed to prevent the cloud host, GPU operator and NEAR AI from accessing their prompts or responses. The launch brings confidential AI processing to Brave’s production browser rather than limiting it to an experimental testing channel.
The announcement addresses a growing concern around AI assistants: users may share personal, financial, professional or otherwise sensitive information with systems whose internal processing they cannot independently inspect. Brave and NEAR AI say their integration combines encryption, hardware security and independent verification to reduce the need to trust a provider’s privacy promises alone.
How NEAR AI Protects Brave Leo Conversations
The integration uses trusted execution environments (TEEs) based on Intel Trust Domain Extensions (TDX) and NVIDIA confidential computing technology. These environments are designed to isolate sensitive workloads from the surrounding infrastructure, including the host operating system. According to NEAR AI, prompts are decrypted only inside the protected environment, while data remains encrypted during other stages of processing.
Encryption begins in the browser before a prompt leaves the user’s device. The request is sent toward the protected environment using a key that, according to the companies, is available only inside the enclave. Brave also uses a relay that strips the user’s IP address before forwarding the request, limiting the information available to NEAR AI about the person making it.
The design separates knowledge of the user’s identity from access to the conversation itself. Brave’s relay handles the request without seeing the prompt’s contents, while NEAR AI’s inference infrastructure processes the encrypted request inside the enclave. The companies say the cloud host and GPU operator cannot read the conversation through the normal serving process.
A central part of the system is hardware attestation, which provides evidence that a workload is running inside a genuine protected environment. Before Brave’s browser releases the required key, its open-source verifier checks the environment’s attestation evidence, including Intel’s signature for the TDX environment and NVIDIA’s attestation for the GPUs. NEAR AI also says the code running in the enclave can be rebuilt from public source to check whether it matches the deployed implementation.
The system is also designed to address concerns about model substitution, where a service might route a request to a different model than the one selected by the user. GLM 5.3 Flash is an open-weights model released under the MIT license, according to the announcement. NEAR AI says attestation and deployment records help verify that the selected model is the one serving the request, although users should distinguish verification of the deployed environment from a guarantee that an AI model’s answers are always correct.
What the Integration Means for NEAR and AI Privacy
Brave says its browser has more than 128 million monthly active users, giving the integration a substantial potential audience. The company had begun experimenting with NEAR AI’s trusted execution environments in Brave Nightly in November 2025, initially running DeepSeek V3.1. The October launch extends the approach to production users who choose GLM 5.3 Flash in Leo.
For NEAR, the integration demonstrates a consumer-facing application for its AI infrastructure beyond crypto-specific use cases. NEAR AI Cloud can provide confidential inference to applications that need to process sensitive information while limiting access by infrastructure operators. The company also points to existing production workloads from Venice AI, Abound and the Government of Bermuda.
Users can access the feature by opening Brave Leo’s model settings and selecting GLM 5.3 Flash. The announcement does not mean every Leo model automatically uses the same privacy architecture, so model selection matters. Users should also understand that privacy protections depend on the implementation, the verification process and the security assumptions of the hardware involved.
The integration does not eliminate every possible risk. Trusted execution environments can reduce exposure to cloud operators, but they do not guarantee that all software vulnerabilities, compromised endpoints or user-side security problems are impossible. Nor does encryption ensure that model responses are accurate or suitable for every decision.
For the AI industry, the release highlights a shift toward privacy claims that can be tested through cryptographic evidence rather than accepted solely through provider policies. Whether this model becomes more widely adopted will depend on performance, cost, usability and the confidence users place in independent verification. For now, Brave Leo’s integration gives users a concrete way to access confidential AI inference directly from their browser.
About The Author
