What is a trusted execution environment (TEE)?

The Morse teamPublished October 19, 20268 min read

A trusted execution environment (TEE) is an area of a computer's processor, or of a whole virtual machine, where code and data are kept isolated in hardware so that nothing outside it, including the operating system, the hypervisor, and the people who run the machine, can read or change them while they're in use. As of October 2026 the Confidential Computing Consortium defines a TEE by three properties: unauthorized entities can't view data in it, can't alter data in it, and can't alter the code running in it (CCC).

We read the Consortium's technical paper, GlobalPlatform's introduction to TEEs, Intel's, AMD's, Arm's, and NVIDIA's own pages, the Linux kernel's documentation for Intel's TEEs, and the researchers' pages for the three memory-bus attacks published in 2025, all on October 19, 2026. Where a vendor's position comes to us through the researchers' page, we say so.

What does a trusted execution environment do?

It keeps data protected while a program is working on it. Encryption has long covered data on disk and data crossing a network, but a program has to decrypt data to compute on it, and at that moment anyone who controls the machine could look. The Consortium's paper calls protecting data in use "the new frontier" and defines confidential computing as "the protection of data in use by performing computation in a hardware-based, attested Trusted Execution Environment" (CCC, v1.3, November 2022).

The term is older than the cloud use. GlobalPlatform, which writes the TEE standards used in phones, describes the TEE as "a secure area of the main processor of a connected device" that sits alongside the main operating system and "offers protection against software attacks generated in the Rich Operating System" (GlobalPlatform, May 2018). On a phone, that's where payment credentials and fingerprint checks live. In a data center, the same idea now covers whole virtual machines and GPUs.

What is remote attestation?

Remote attestation is how a TEE proves, to someone far away, what it is and what code it's running. The Consortium describes it as evidence "of its origin and current state" that another party can check before deciding to trust the code, and says it matters that the evidence "is signed by hardware that can be vouched for by a manufacturer" (CCC).

Without it, a TEE helps only the people who run the machine. With it, you can check a measurement of the exact software before you send anything, and send nothing if it doesn't match. The chain behind it differs by vendor. In Intel TDX, the TEE first produces a report that "can only be verified on the local platform," and TDX "leverages Intel SGX Quoting Enclave" to turn it into a quote a remote party can verify (Linux kernel docs). NVIDIA's H100 signs its evidence with "a device-unique ECC-384 key pair" whose private key "is burned into the fuses of each H100 GPU," and NVIDIA's Remote Attestation Service is the main way to check it (NVIDIA, August 2023).

TEE vs enclave: is there a difference?

Mostly a difference of size and vendor vocabulary. "TEE" is the general term. Intel SGX calls its TEEs enclaves: private memory regions inside one application, where "only the threads inside the enclave can access its memory" (Linux kernel docs). Newer designs isolate a whole virtual machine instead. Intel calls those trust domains, AMD calls them confidential VMs, and Arm calls them Realms. AI apps, Morse included, often say "secure enclave" for any of these.

How is a TEE used for AI?

It lets a model answer a prompt that the company running the server can't read. NVIDIA says its confidential computing protects "data, model weights, and inference at runtime" on Hopper, Blackwell, and Rubin GPUs, at "up to 98% of the performance of unsecured deployments" (NVIDIA). An AI app can run an open-weight model inside an attested TEE and have your device encrypt the prompt for that TEE alone. We walk through that flow, step by step, in how end-to-end encrypted AI chat works.

Which TEEs exist, and which run AI on GPUs?

Here are the main server TEEs as their makers describe them, read on October 19, 2026. Where a vendor's page doesn't say, the cell says so.

NVIDIA's H100 leaves its on-package memory unencrypted, which NVIDIA considers "secure against everyday physical attack tools." The GPU's protection starts from a CPU confidential VM, which the TEE.fail researchers say is used "for the trust anchor in" NVIDIA's GPU confidential computing (TEE.fail), so the CPU TEE is part of the GPU's trust chain.

Can a trusted execution environment be broken?

Yes, by someone with physical access to the server, in three research attacks published in 2025. Each one put a device on the memory bus between the processor and its RAM:

• WireTap (CCS 2025) targets Intel SGX on DDR4 servers. The authors say it costs "under $1000" and extracted "an SGX secret attestation key from a machine in fully trusted status" (WireTap).
• Battering RAM (IEEE S&P 2026) uses an interposer that "can be built for less than $50." On DDR4 it gave "arbitrary plaintext access to SGX-protected memory" and broke SEV-SNP's attestation "on fully patched systems." The researchers couldn't test Arm CCA because "no hardware is available yet" (Battering RAM).
• TEE.fail (IEEE S&P 2026) moves to DDR5 for "under $1000." The researchers extracted keys from Intel TDX and from AMD SEV-SNP with Ciphertext Hiding, used Intel's provisioning certification key to forge SGX and TDX attestations, and showed that "extracted attestation keys can be used to compromise Nvidia's GPU Confidential Computing" (TEE.fail).

What the attacks need

Every attack needs physical access to the machine. None is a remote software exploit. The weakness is that this memory encryption "is deterministic," as the TEE.fail researchers put it, so the same data encrypts the same way each time, and the kernel's SGX documentation says newer SGX parts dropped the integrity tree that would catch replayed memory.

Is physical access in a TEE's threat model?

The vendors and the Consortium answer differently. According to the TEE.fail page, Intel considers these attacks "out of the threat model for Intel SGX and TDX," AMD "considers interposer attacks to be out of scope for SEV-SNP," and NVIDIA says "there are no mitigations from the Nvidia CC side." Yet the Consortium's own threat model lists "bus and cache monitoring" among the basic physical attacks that are in scope for confidential computing, leaving only invasive, long-term attacks like chip scraping out of scope (CCC). The Linux kernel's TDX documentation also says TDX protects guest VMs "from the host and physical attacks" (kernel). AMD's SEV page now lists "Physical & Side Channel Attack Mitigations" for its EPYC 9006 generation, without detail (AMD). In practice, a TEE today protects you from the host's software and its administrators, while the server's physical security still rests on whoever runs the data center.

How Morse checks the TEE before you send

A TEE keeps your prompt from the host only if your own device confirms, before sending, that the prompt is going into one. When the service's server checks the attestation for you, you're trusting that server again. In Morse's E2EE mode, your browser verifies the enclave's hardware attestation itself and seals the message for that enclave only after the check passes, so Morse's servers carry text they can't read. The guarantee depends on the enclave hardware and attestation working as designed, and the attacks above show which part of it rests on the data center's physical security. Each check, and the report you can download, is in how end-to-end encrypted AI chat works.

• E2EE, when even the host mustn't read the prompt. Open-weight models answer inside an enclave your browser has verified.
• Private, when the host may read it but mustn't keep it. Morse has zero data retention agreements with its inference, search, and other providers.
• Anonymous, when you need GPT, Claude, or Gemini. The provider sees the message without knowing it's you.

Your chat history stays encrypted in your browser. How to use AI privately matches each mode to who you're hiding from.

How to judge any app's TEE claim

• Who checks the attestation? Your device, or the company's server. In Morse's E2EE mode, your browser does.
• Which TEE, and which GPU? The table above shows what each one encrypts and where its proof comes from.
• What does the check compare against? A pinned, known version of the software, or only proof that the chip is genuine.
• Who can touch the servers? The 2025 attacks need physical access, so the data center's physical security is part of the guarantee.
• What does it cover besides the model? Web search, file reading, and chat history each happen somewhere. Ask where.

E2EE chats come with Pro, at $19 a month, so you can start free, upgrade, and open the lock on your first reply today.