Industry21 Oct 20264 min read

Five weeks, seven giants: AI is moving into confidential computing

Between 14 September and 19 October 2026, Apple, NVIDIA, Google, Meta, OpenAI, Anthropic, and Microsoft each made a move in confidential computing, in which AI runs inside trusted execution environments.

Photo of NVIDIA HGX B200, a board of eight Blackwell GPUs, on a white display table at Computex 2024. — Photo: Geekerwan, CC BY 3.0

For most AI chats, privacy rests on a company's policy: the company promises not to look, and users take it at its word. A TEE replaces that promise with verification. It keeps data encrypted in memory while a model works on that data, and it proves with a signed attestation which software it runs.

"Apple, AWS, Google, Nvidia, and Microsoft all have some form of private cloud compute infrastructure for AI," The Register wrote on 16 October.

Apple: the next Apple Intelligence runs on Private Cloud Compute

On 14 September, Apple shipped the next generation of Apple Intelligence. Its new foundation models were "custom-built in collaboration with Google and its Gemini models," and they "run on device and on servers using Private Cloud Compute," the server platform that Apple built for private AI.

In June, Apple began extending Private Cloud Compute to Google Cloud systems with NVIDIA GPUs, first as a summer preview. These systems are built on NVIDIA Confidential Computing, Intel Trust Domain Extensions (TDX), and Google's Titan chip. Apple will publish the software that runs on them too: "all binaries will be published for public inspection."

NVIDIA: confidential computing costs a few percent

On 22 September, NVIDIA published a controlled test on eight B200 GPUs serving DeepSeek-R1. With confidential computing on, the system kept 96.1% to 98.2% of its throughput and added 1.2% to 4.3% to the time per token, at 1 to 16 concurrent requests. It is NVIDIA's own test. Two preprints from companies that build confidential inference point the same way for a tuned serving stack, the software that serves the model, as we report in our article on open-weight models.

Google and Meta: even the company cannot access your data

On 23 September, Google described secure server-side memory for Private AI Compute, its private cloud for Gemini. The keys to that memory "are held exclusively on your personal devices — ensuring your data is inaccessible to anyone else, even Google."

The same day, Meta described how it is bringing Private Processing to its AI glasses. Private Processing is the confidential computing system behind the private AI features of WhatsApp, and its models run inside confidential virtual machines, "such that even Meta cannot access your data." In May, Meta introduced Incognito Chat with Meta AI, built on the same system and rolling out over the following months. In Incognito Chat, "no one — not even Meta — can read your conversations," Meta wrote.

OpenAI, Anthropic, and Microsoft join in

On 29 September, at DevDay, OpenAI announced a preview of Private Inference for fall 2026. It "combines confidential computing with strict, verifiable controls," OpenAI wrote. OpenAI had not said which hardware it would use, VentureBeat noted.
On 13 October, Opaque, a confidential AI startup valued at $300 million in February, wrote that "our team is joining Anthropic to carry OPAQUE's work forward."
On 19 October, Microsoft detailed a reference architecture for sensitive AI on Azure confidential computing, with NVIDIA H100 GPUs in confidential mode.

One design: a TEE that proves what it runs

Most of these systems share one design: the model runs in a TEE, and the TEE proves with an attestation which software it runs. In the designs that Apple and Meta describe, the user's device verifies that attestation before it sends anything. Google's technical brief describes a first step: server instances receive a cryptographic key once they pass hardware and software attestation, and "Clients verify this key before transmitting any data." The brief lists client-side attestation verification as the next step.

One of the six signals that the Confidential Computing Consortium drew from the Confidential Computing Summit 2026 says the same: "The new standard is verifiable, not trustworthy."

What it means for you

The largest companies in AI now build private AI into phones, glasses, and clouds.

Thinkr uses the same design. Its private lane, the default, runs open-weight models in TEEs. Before your browser sends a word, it verifies the enclave's remote attestation; then every chat is encrypted on your device and decrypted only inside the enclave. Thinkr offers this to anyone with a browser, and it labels every model with how private it is.