Is Telegram AI private? What Cocoon hides, and from whom

The Morse teamPublished November 1, 20267 min read

As of November 2026, Telegram's AI features are private from the people whose GPUs run them, but Cocoon's own documents don't keep them from Telegram. AI summaries, the AI Editor, and AI sticker search run on Cocoon, a network that processes requests inside hardware enclaves, and Cocoon's own architecture page says the part of the system that sees your prompt and the answer runs on servers, with "the Telegram backend" as its example. Your ordinary Telegram chats aren't end-to-end encrypted either, so the text an AI feature works on usually sits on Telegram's servers already.

We read Telegram's FAQ, its privacy policy, its blog posts announcing each AI feature, and Cocoon's site, architecture page, GPU-owner guide, and GitHub repository on November 1, 2026. Cocoon earns credit on its own pages. It checks every machine's attestation before talking to it, publishes the allowed software fingerprints where anyone can check them, and releases its worker software as open source. What those pages leave open is who runs the client that sends each request and reads each answer.

Telegram AI privacy at a glance

What AI features does Telegram have?

Telegram added AI summaries on January 3, 2026, for long channel posts and Instant View pages (Telegram). Instant View pages get an automatic summary at the top. On March 31, 2026, it added an AI Editor in the message bar that fixes grammar, rewrites a draft in a style such as Formal or Short, and translates (Telegram). The editor's "Ai" icon appears above the Send arrow once you've typed more than three lines. On May 7, 2026, Telegram let users build custom AI styles from their own prompts, with a shareable link for each (Telegram).

What is Cocoon, and who can see your requests?

Cocoon, short for Confidential Compute Open Network, is Telegram's network of rented GPUs where "GPU owners mine TON by powering the network" (Cocoon). Both the GPU machines (workers) and the routers between them (proxies) run inside trusted execution environments, "currently Intel TDX" (Cocoon). Cocoon says this keeps prompts and responses from "server owners." Every connection checks the other side's attestation through RA-TLS, at connection time rather than per request. The allowed software fingerprints live in an on-chain registry, and Cocoon says "Anyone can verify against this on-chain registry." Our guide to trusted execution environments explains what that hardware protects and what physical attacks it doesn't.

The same page says "Only the client can see prompts and responses," and the client "is designed to run on servers (backend infrastructure)" (Cocoon). A library for phones and desktop apps "is being developed." For now, "Proxies are operated by the COCOON team," and the registry is "Currently centralized (COCOON team manages updates)."

Can Telegram see what you send to its AI?

Cocoon's design leaves Telegram able to, and Telegram's pages don't say otherwise. Cocoon's architecture page uses Telegram as its example of a client: "the Telegram backend would run multiple client instances to handle user requests" (Cocoon). The client is the one party that sees prompts and answers. Telegram's FAQ says AI processing happens in an isolated, encrypted environment and that its AI features "never send any data to third parties" (Telegram FAQ). Neither page says whether Telegram's own servers can read the requests.

For channel summaries this matters little, since the post is already on Telegram's servers for anyone in the channel. It matters more for the AI Editor, which reads the draft you're about to send. The architecture page also says the image fingerprint covers the base image and static settings, while the model's name and download location are runtime settings that are "not measured." It lists approved model hashes in the registry without saying how a worker proves which weights it loaded. If you want to know what that check involves, our guide to verifying an AI enclave's attestation walks through it.

Does Telegram translation send your messages to Google?

Telegram's own pages disagree. The FAQ says AI features "including translation" run on Cocoon and send nothing to third parties (Telegram FAQ). Section 8.4 of the privacy policy, last updated August 21, 2026, says Telegram "may rely on Google LLC or Microsoft Corporation" for translation, and that the text you choose to translate "may be shared with Google or Microsoft" (Telegram privacy policy). The policy limits them to providing the translation, with no other products or advertising. Section 8.5 says Premium's Voice-to-Text may send the audio of the message you convert to Google, without your IP address or account. Google may not log the audio or the transcript. Until Telegram reconciles the two pages, treat the privacy policy as the binding one.

Are Telegram chats end-to-end encrypted?

Only Secret Chats. Telegram's FAQ says cloud chats, both private and group chats, "use client-server/server-client encryption and are stored encrypted in the Telegram Cloud" (Telegram FAQ). Secret Chats add client-to-client encryption and stay on the two devices they were made on. Telegram says it splits the decryption keys across jurisdictions, so that "several court orders from different jurisdictions are required to force us to give up any data." That's Telegram's description of its own setup. Section 8.3 of its privacy policy says that on a valid court order in a criminal case, Telegram "may disclose your IP address and phone number to the relevant authorities" (Telegram privacy policy).

Do AI bots in Telegram see your chats?

A guest AI bot sees only the message you tag it in. Telegram says a bot you tag by @username can read "the specific message they are tagged in and any replies to that message," and "cannot see which users are in the chat" (Telegram). Any bot is someone else's service, though. Telegram's FAQ says that using AI through a third-party bot or mini app means "using a third-party service, not Telegram," with that developer's own privacy policy (Telegram FAQ). The same applies to AI Guardians, the bots group admins can add to screen people who ask to join (Telegram). Meta's AI inside WhatsApp raises a different set of questions, which we covered in WhatsApp's hidden AI instructions.

How Morse keeps your AI chats from a server that can read them

Telegram's AI has the same weak point as its cloud chats. On Cocoon's own design, your words reach a Telegram server before they reach an enclave, and the enclave protects them from the GPU owners, not from that server. In Morse's E2EE mode, our servers in the middle relay text they can't read, and in every mode your chat history stays in your browser instead of on our servers.

• E2EE, for anything you'd want sealed before it leaves your phone or laptop. Your browser checks the enclave's hardware attestation itself, against versions pinned in the app, then encrypts the message so only that enclave can read it. Morse's servers relay ciphertext they can't read, and the enclaves are run by third-party providers, not by Morse. Every reply has a lock you can open to see each check that passed, and a full report you can download. The guarantee rests on the enclave hardware and attestation working as designed. E2EE runs open-weight models such as GLM, Kimi, and DeepSeek, without web search or image generation.
• Private, for everyday questions you'd rather no host kept. Open-weight models and Grok answer under zero data retention: Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing.
• Anonymous, for GPT, Claude, or Gemini without your name on it. Our proxy removes your account, email, and IP address, so the provider sees the message without knowing it's you. It may keep it for a limited time to check for abuse, under its own policy.

In every mode, your history is stored in your browser, encrypted, and locked when you sign out. Morse doesn't train AI on your content, sell your data, or show ads, and because we don't store chats, we usually have very little to give authorities. Deleting a chat on your device deletes it for good, and Morse can't recover it either, so keep a copy of anything you need.

So is Telegram AI private enough for you?

• Summaries of public channels: fine for most people. The post is already on Telegram's servers and visible to the channel.
• Rewriting a private message with the AI Editor: assume Telegram can read the draft, as it can read the cloud chat you send it in. For something private, draft it in a Morse E2EE chat and send it in a Telegram Secret Chat.
• Translating messages: the privacy policy allows Google or Microsoft to receive the text. Leave sensitive messages untranslated.
• AI bots: read the bot developer's own policy before you tag a bot.
• Questions you'd never want stored: ask them where the history stays on your device.

You can try a chat from the Morse home page without an account, or start free with no card. E2EE chats come with Pro, at $19 a month.