The Solana Foundation has released Solana Confidential Compute, open-source tools that let apps check on Solana whether an AI model or agent is running inside sealed, private hardware. Built with the private AI startup Nito, the tools are in beta on Solana SOL$79.55-2.0% devnet. They have not been audited yet, and the Foundation says they are for development use only.
The Foundation announced the release on X on 13 November 2026 under the line "Private AI, verified onchain", alongside a launch post on its new solana.ai site. The release targets a familiar problem with private AI services: when an operator says your prompts stayed private, users usually have to take its word for it.
What Solana Confidential Compute does for private AI apps
Solana Confidential Compute lets a Solana program or AI agent confirm that a piece of software is running inside confidential hardware before it trusts that software's answers. The check happens onchain, so any app can read the result instead of trusting the company running the server.
The hardware in question is a trusted execution environment, or TEE. The Foundation's thread describes TEEs as "hardware-backed environments that isolate code and data from the surrounding system, including the host operating system and infrastructure operator." Think of a locked room inside the processor: the cloud provider owns the building but cannot see what happens in that room. The chip can also sign a report, called an attestation, saying what code is running in it. Solana Confidential Compute puts the check of that report on Solana, where every app can read the same answer. In the Foundation's words, applications "can check a signing key's attestation status before accepting its signed outputs."
How onchain TEE attestation works on Solana devnet
The Solana Foundation's launch post sets out the flow in four steps:
- A machine running inside a confidential virtual machine creates a signing key that exists only inside that hardware.
- The hardware signs a report that ties the key to a recent Solana slot, which proves the report is fresh.
- An onchain program verifies the report and records the key, the hardware type and an expiry date.
- The machine signs its answers with that key. Anyone receiving an answer checks the signature and looks up the key's record on Solana.
The Confidential Compute product page says the Solana program checks three things: that the chip's signature is genuine, that the code matches an approved list, and that the attestation is fresh rather than replayed. The heavy verification happens once. After that, according to the same page, any program or agent can check the public record "for at most 1,500 compute units", the unit Solana uses to meter the work a transaction does. That cheap lookup is what makes the design fit Solana: a trading agent or a prediction market can confirm a key's status inside its own transaction instead of calling out to a separate service.
Supported hardware: Intel TDX and AMD SEV-SNP, with NVIDIA GPUs in development
The beta supports Intel TDX and AMD SEV-SNP attestations, and NVIDIA GPU attestation is in development, according to the Foundation's launch post and its thread on X. Intel TDX and AMD SEV-SNP are the confidential-computing features of Intel's and AMD's server processors.
The Confidential Compute product page describes the supported setups in cloud terms, naming AMD SEV-SNP on Google Cloud's Confidential VMs, AWS Nitro Enclaves and Google Confidential Space. The same page lists the developer kit:
- a verifier program on Solana devnet
- Rust and TypeScript SDKs, with helpers for verifying inside a program
- an enclave daemon and a command-line tool
- a Docker image
Devnet beta and unaudited: what developers can use now
Solana Confidential Compute is a devnet beta with no audit yet. The launch post says it "hasn't been audited yet, so use it for development for now", and the product page says the security audit is in progress, with mainnet following once the audit lands. No mainnet date has been announced.
Developers who want to see it working can try Solana Confidential Chat, which the Foundation describes as end-to-end encrypted AI chat running in attested hardware. Per the product page, Confidential Chat sends prompts through Tinfoil's confidential router, which runs the GPT-OSS 120B model inside confidential hardware, and the user's browser checks Tinfoil's attestation itself. The launch post also points builders to a Confidential Chat template on solana.com as the starting point.
Who built Solana Confidential Compute: Nito and former Switchboard engineers
The Nito team built Solana Confidential Compute with the Solana Foundation, and the launch post says that team includes engineers who joined from Switchboard. Nito sells a private AI assistant that runs open-weight models, and it already markets privacy as a hardware property: in a 12 November post, Nito wrote that keeping your data yours requires "privacy enforced by verifiable hardware."
The Foundation's thread says Nito is building on the infrastructure and that other teams can use the same tools. It names personal assistants, agents that handle sensitive business data and private trading strategies as the target uses. The launch post adds an AI judge for prediction markets or insurance claims, trading agents whose model execution can be verified, and governance decisions made by verified models.
The release arrives with solana.ai, a new Foundation hub for AI builders that also lists pay.sh, payment channels, an agent registry and a Solana MCP server. It follows Solana's Request for Startups earlier this week, which included AI wallet advisors among its 11 ideas.
How TEE attestation compares with Arcium's MPC and other Solana privacy tools
Solana now has several privacy approaches, and each one asks users to trust something different. A TEE puts the trust in the chip: because the hardware signs the attestation, a user relying on Solana Confidential Compute trusts Intel, AMD or, later, NVIDIA to have built and signed it correctly, in place of trusting the server operator.
Arcium takes a different route with multi-party computation (MPC), which splits a computation across several independent nodes so that no single one sees the data. Arcium applied that to AI with Blackthorn, which we covered at launch in June and when it opened to selected users in October. On the payments side, Helius hSOL$94.60-1.4% earlier this week launched Privacy Rings on mainnet to encrypt balances and transfer amounts, and Solana's zero-knowledge Confidential Transfers returned to mainnet in June.
Hardware attestation has come up on Solana before. Jito JTO$0.311-0.6% published a design in September for BAM attestations that use TEE proofs so validators can verify how transactions were ordered. Solana Confidential Compute applies the same idea to AI, as a shared tool any team can call.
What to watch before Solana Confidential Compute reaches mainnet
The next milestones the Foundation has named are the security audit, the mainnet release that follows it, and NVIDIA GPU attestation. The other thing to watch is whether teams beyond Nito ship products on the verifier once it is audited.
