Between 14 September and 19 October 2026, Apple, NVIDIA, Google, Meta, OpenAI, Anthropic, and Microsoft each made a move in confidential computing, which runs AI inside trusted execution environments (TEEs).

For most AI chats, privacy has rested on a company's policy: the company promised not to look, and users took it at its word. A TEE replaces that promise with verification. It keeps data encrypted while a model works on it, and it proves with a signed attestation which software it runs.

"Apple, AWS, Google, Nvidia, and Microsoft all have some form of private cloud compute infrastructure for AI," The Register wrote on 16 October.

Apple: the next Apple Intelligence runs on Private Cloud Compute

On 14 September, Apple shipped the next generation of Apple Intelligence. Its new foundation models were "custom-built in collaboration with Google and its Gemini models," and they "run on device and on servers using Private Cloud Compute," the server platform that Apple built for private AI.

In June, Apple began extending Private Cloud Compute to Google Cloud systems with NVIDIA GPUs, first as a summer preview, built on NVIDIA Confidential Computing, Intel TDX, and Google's Titan chip. Apple will publish the software there too: "all binaries will be published for public inspection."

NVIDIA: confidential computing costs a few percent

On 22 September, NVIDIA published a controlled test on eight B200 GPUs serving DeepSeek-R1. With confidential computing on, the system kept 96.1% to 98.2% of its throughput and added 1.2% to 4.3% to the time per token, at 1 to 16 concurrent requests. It is NVIDIA's own test. Two preprints from companies that build confidential inference point the same way for tuned stacks, as we report in our article on open-weight models.

Google and Meta: the keys stay with you

On 23 September, Google described a memory for Private AI Compute, its private cloud for Gemini, whose keys "are held exclusively on your personal devices — ensuring your data is inaccessible to anyone else, even Google."

The same day, Meta described how it is bringing Private Processing to its AI glasses. Private Processing is the confidential computing system behind the private AI features of WhatsApp, and its models run inside confidential virtual machines, "such that even Meta cannot access your data." In May, Meta introduced Incognito Chat with Meta AI on the same system, rolling out over the following months, in which "no one — not even Meta — can read your conversations."

OpenAI, Anthropic, and Microsoft joined in

  • On 29 September, at DevDay, OpenAI announced a preview of Private Inference for this fall. It "combines confidential computing with strict, verifiable controls," OpenAI wrote. OpenAI has not yet said which hardware it will use, VentureBeat noted.
  • On 13 October, Opaque, a confidential AI startup valued at $300 million in February, wrote that "our team is joining Anthropic to carry OPAQUE's work forward."
  • On 19 October, Microsoft detailed a reference architecture for sensitive AI on Azure confidential computing, with NVIDIA H100 GPUs in confidential mode.

One design: a TEE that proves what it runs

Most of these systems share one design: the model runs in a TEE, and the TEE proves with an attestation which software it runs. In the designs that Apple and Meta describe, the user's device verifies that attestation before it sends anything. Google's technical brief describes a first step, "Clients verify this key before transmitting any data," and lists client-side attestation verification as what comes next.

One of the six signals that the Confidential Computing Consortium drew from the Confidential Computing Summit 2026 says the same: "The new standard is verifiable, not trustworthy."

What it means for you

The largest companies in AI now build private AI into phones, glasses, and clouds.

Thinkr uses the same design. Its private lane, the default, runs open-weight models in TEEs. Before your browser sends a word, it verifies the enclave's remote attestation; then every chat is encrypted on your device and decrypted only inside the enclave. Thinkr offers this to anyone with a browser, and it labels every model with how private it is.

Sources