Open-weight models you can run in a TEE now beat the flagships of early 2026
The best open-weight models now outscore the closed flagships of February 2026 on an independent index, and on a tuned serving stack, trusted execution environments run them at close to full speed.
The best open-weight models now outscore the closed flagships Google and OpenAI shipped in February 2026, and anyone can run them inside a trusted execution environment (TEE), where even the server's operator cannot read the chat.
The newest is a build of DeepSeek V4.1 Flash that DeepSeek released on 17 October under the MIT license. It joined Xiaomi's MiMo-V2.6-Pro and GLM-5.3 at the top of the open-weight field, with Step 5 Preview and Kimi K3 close behind.
Open-weight models passed the February flagships
Artificial Analysis runs major models through the same set of evaluations, so its Intelligence Index compares like with like. On 21 October 2026, version 4.3.2 of the index read:
| Model | Weights | Score |
|---|---|---|
| MiMo-V2.6-Pro | Open, MIT | 46 |
| DeepSeek V4.1 Flash, 17 Oct build (max) | Open, MIT | 45 |
| GLM-5.3 (max) | Open | 45 |
| Step 5 Preview | Open | 44 |
| Kimi K3 (max) | Open | 44 |
| GPT-5.6 Terra (max), July 2026 | Closed | 42 |
| DeepSeek V4.1 Flash, September build (max) | Open, MIT | 39 |
| Qwen3.8 27B (xhigh) | Open, Apache 2.0 | 34 |
| GPT-5.3 Codex (xhigh), February 2026 | Closed | 33, estimated |
| Gemini 3.1 Pro Preview, February 2026 | Closed | 30 |
Five open-weight models now score above GPT-5.6 Terra, which OpenAI released in July. Qwen3.8 27B, a model of only 27 billion parameters under the Apache 2.0 license, also beats both February flagships.
The gap is now counted in months
The best closed models still lead: Claude Opus 5.5, released in September, scores 58 on the same index.
Epoch AI, which tracks the capability of models across many benchmarks, measures that lead in months. It found in May 2026 that "since January 2026, the most capable open-weight models have lagged frontier closed models by an average of four months" on its capability index. Epoch puts that gap at 8 points, about the step from GPT-5 to GPT-5.5.
On a tuned stack, TEEs run them at close to full speed
A strong open-weight model helps privacy only if it can run inside a TEE: hardware that keeps data encrypted in memory and proves, with a signed attestation, exactly what code it runs. In 2026, running a model in a TEE cost 1% to 8% of throughput on a tuned serving stack, the software that serves the model.
- In July 2026, NVIDIA served Qwen3.5-397B on an HGX B300 with confidential computing on, under Intel Trust Domain Extensions (TDX). Throughput fell by 1.0% to 7.5% across 4 to 256 concurrent requests. Once the workload runs, NVIDIA wrote, "attestation does not add latency to individual inference requests."
- A team at Mozilla benchmarked a standard confidential instance with one H100 under Intel TDX. Throughput fell by 17.7% to 21.1%. The authors write that the results suggest confidential GPU inference "can retain usable throughput under load," as long as capacity planning accounts for the penalty.
- Two preprints from companies that build confidential inference, one on B200 and one on B300, report that a tuned serving stack wins back most of what a default setup loses.
So the cost runs from a few percent on a tuned stack to about a fifth on a standard confidential instance with one H100. Either way, the model inside the TEE stays the same; only its speed changes.
Open-weight models in TEEs already serve users
- Since 15 October 2026, Brave's assistant Leo has encrypted each chat end to end, from the browser to an enclave of NEAR AI, which runs the open-weight GLM 5.3 Flash on NVIDIA GPUs in confidential computing mode. The feature is available in Brave's release channel.
- NEAR AI serves a catalog of open-weight models, Kimi K3 among them, each inside an attested enclave.
The largest companies in AI are moving the same way, as we report in Five weeks, seven giants.
What it means for a private chat
In 2026, the best open-weight models trail the closed frontier by about four months, and on a tuned stack a TEE runs them at close to full speed.
Thinkr is built on both facts. Its private lane, the default, runs open-weight models such as Kimi K3 and DeepSeek V4.1 Flash in TEEs. Before your browser sends a word, it verifies the enclave's remote attestation; then every chat is encrypted on your device and decrypted only inside the enclave.
Sources
- Artificial Analysis, Intelligence Index v4.3.2, model pages read 21 Oct 2026.
- DeepSeek, "DeepSeek-V4.1-Flash-1017", Hugging Face, 17 Oct 2026.
- Epoch AI, "Open models lag state-of-the-art closed models by 4 months", Jack Edwards and Luke Emberson, 29 May 2026.
- NVIDIA, "Hardware-rooted AI security that won't slow you down", 2 Jul 2026.
- Wang, Waqas, and Smith (Mozilla), "Benchmarking Confidential GPU Inference on NVIDIA H100 under Intel TDX", arXiv, 20 May 2026.
- Asad and Grunseid (Confidential.ai), "Benchmarking Confidential Computing Performance on NVIDIA Blackwell GPUs", arXiv, 27 Aug 2026.
- Yin and Wang (Phala), "The Serialized Bridge: Understanding and Recovering LLM Serving Performance under Blackwell GPU Confidential Computing", arXiv, 22 Jun 2026.
- Brave, "Another Brave User-First AI Win: Leo adds End-to-end Encryption, Oblivious HTTP, and Verifiable Confidential Computing", 15 Oct 2026.
- NEAR AI, "Private AI inference you can verify", read 21 Oct 2026.
