Solana Foundation Launches On-Chain Hardware Verification for Private AI

The Solana Foundation released an open-source toolkit on Nov. 13 that lets developers build private AI applications and verify the underlying computing hardware through records on the Solana blockchain. The toolkit, called Solana Confidential Compute, was built with Nito and is currently available only in beta on Solana's devnet. A mainnet version is planned; the Foundation gave no release date.

The announcement, which the Foundation summarized on X as "Private AI, verified onchain," carries clear caveats. The tools are unaudited and intended for development and testing, not production use. That limitation sits at the center of the release, even if the promotional framing does not foreground it.

How does the verification actually work?

The system relies on trusted execution environments, or TEEs, which isolate code and data from the surrounding infrastructure, including the host operating system and whoever operates it. Inside a confidential virtual machine, software generates a signing key that stays within protected hardware.

A hardware-signed report links that key to a recent Solana slot. An on-chain verification program checks the report, then records the key, the hardware type, and an expiration date. When the machine produces an output, it signs the result with the same key, and an application can check the signature against the Solana record before accepting the answer.

The beta supports hardware attestations from Intel TDX and AMD SEV-SNP. NVIDIA GPU attestation remains in development. The AI computation itself happens off-chain; publishing a verification record does not expose a user's conversation or private inputs.

In plain words: the blockchain proves which hardware produced an answer, not what the answer cost anyone to compute.

What can developers see, and what stays hidden?

The Foundation's chat template, built with Next.js and React, encrypts prompts in the browser before they travel. The browser verifies the confidential environment first; if verification fails, the prompt is not sent. Encrypted messages pass through the application's server and through Nito to the protected environment, and responses return encrypted.

The documented design still leaves specific data exposed:

• The application server can see a visitor's IP address.
• Nito can see the account, the model used, request timing, and the encrypted message size.
• Developers must implement their own authentication, rate limiting, and bot protection.
• The example requires a funded Nito account and API key.

Verification also has a structural limit. It identifies a published software release; it does not establish that the release is free of bugs. Developers still depend on the webpage code they serve, the hardware manufacturer's attestation, and the software running inside the environment. In plain words, the chain confirms identity and freshness, not correctness.

Who is this for?

The Foundation listed personal assistants, agents handling confidential business data, and private trading strategies as potential applications. Developers could check a signing key's attestation status before accepting signed results. The announcement also raised AI rulings for prediction markets or insurance claims, trading orders accepted only from verified machines, and AI governance decisions.

These remain concepts, not shipped products. The announcement describes capabilities the toolkit enables, not applications anyone has yet deployed at scale.

The launch follows related Solana activity. On Nov. 9, Solana outlined 11 startup ideas, including an open AI inference marketplace and a wallet-based financial assistant requiring explicit user approval before executing actions. Helius launched Solana Privacy Rings on mainnet on Nov. 10, encrypting balances while leaving sender and recipient addresses visible. Umbra and Streamflow introduced confidential token vesting on May 26 using Arcium's infrastructure.

In the United States, SEC Chairman Paul Atkins said in December 2025 remarks, speaking in a personal capacity, that zero-knowledge proofs and selective disclosure could let users demonstrate compliance without revealing their full financial history.

The decisive test arrives when the toolkit ships to mainnet, presumably with an audit; until then, every privacy claim here rests on devnet software that its own publisher describes as unreviewed.