Leo’s protected GLM route combines encryption with remote processing inside a trusted execution environment.
The Register reports that Brave has connected its Leo assistant to Z.ai’s GLM 5.3 Flash under end-to-end encryption, following an experiment launched last November with NEAR AI’s trusted execution environment (TEE). A prompt is encrypted on the device and sent using Oblivious HTTP, a protocol that separates a network request from its content. Brave’s AI Gateway forwards the encrypted query to the TEE without passing along the user’s IP address; after Brave verifies the enclave’s attestation, the browser encrypts the query with a key bound to the TEE, which decrypts it, runs the model and returns an encrypted reply.
The article frames this as going against a trend of agents asking for extensive personal data and companies reusing conversations for training. Brendan Eich, Brave’s co-founder and CEO, is quoted in a statement. The page is a news report of Brave’s design;
In plain English
A “trusted execution environment” is a sealed area of a processor that even the server’s owner cannot read. “Attestation” is a signed proof of what software is running inside it. “End-to-end encryption” means only the sender and the intended recipient can read the message.
Why it matters
It is a concrete design for private AI chats where the provider is not supposed to see prompts, a requirement that is likely to come up when marketing teams put customer data into AI tools.
A useful way to read this design is to separate the journey of a message into stages. The browser prepares it, a relay carries it, a remote system processes it and the answer comes back. Encryption during transport addresses one exposure point; protecting the message while a model processes it addresses another. The trusted hardware is central to the latter claim.
That is different from running a model entirely on your own computer. The computation still happens remotely. The privacy argument depends on the hardware boundary and on checking that the expected software is running inside it. It should therefore be evaluated as a specific architecture rather than a blanket promise that every AI interaction is private.
Users should also distinguish the protected model route from other assistant features or models. A statement about this configuration should not be extended automatically to every service available in the browser. Local chat history, information copied into other applications and material intentionally shared by the user are separate questions.
The practical development is that privacy controls are becoming part of the product architecture, rather than only a statement about retention. Whether the implementation delivers the intended protection requires technical verification; the news report describes the design and does not supply an independent security audit.