STATE OF PRIVATE AI · 2026

The state of
private AI, 2026.

Who can read what you ask an AI service, who trains on it, and what open models’ publishers report. Taken from the services’ own pages and our own measurements, each with its source. A first edition, small on purpose: it says only what we could cite or count.

Services read: 29 October 2026
Written: 31 October 2026
Compared: Undergrove · ChatGPT · Claude · Mistral Vibe · Lumo
Data

01 · Training

Whether your chats train the next model is still a setting

Of the five services compared, two train on personal-plan conversations unless you turn it off, one asks first, and two say they don’t, Undergrove among them. Business plans often differ; these are personal plans, as each service describes them.

UndergroveUndergroveDoesn’t train on chats
No. We keep no conversation content we can read, and the models’ makers never receive your messages. [1]
ChatGPTOpenAITrains by default
Yes by default on personal plans. You can turn off “Improve the model for everyone” in Settings › Data controls; Temporary Chats aren’t used. [2][3]
ClaudeAnthropicTrains only if you allow it
If you allow it, under Model Improvement in Privacy Settings, and when a chat is flagged for safety review. Incognito chats aren’t used. [4][5]
Mistral VibeMistral AITrains by default
Yes by default on personal plans; you can opt out in settings. Enterprise customers are opted out by default. [6][7]
LumoProtonDoesn’t train on chats
No, Proton says. [8]

From each service’s own pages, read on 29 October 2026. Open a row for its words and sources.

02 · Processing

Protection while a model reads is the rare claim

Encryption in transit and at rest is widely described. Protection while a model is reading your words is not: of the five, only one states it for its chat product, and that one is ours, which hasn’t been independently assessed yet. One other provider has published research on the idea and calls it early work.

UndergroveUndergroveStates hardware protection
Yes, in the workspace: messages are decrypted only inside a hardware enclave whose attestation your browser checks before sending. Your browser verifies Tinfoil’s router enclave; the model’s own enclave is verified by the router, and by your browser where its hardware allows. [9]
ChatGPTOpenAINot stated
Not stated for personal plans. OpenAI’s business pages describe encryption at rest (AES-256) and in transit (TLS 1.2 or higher). [10]
ClaudeAnthropicNot stated
Not stated for the Claude apps. Anthropic has published research on confidential inference with trusted virtual machines, which it describes as early work. [11]
Mistral VibeMistral AINot stated
Not stated. Mistral describes encrypted backups replicated across EU zones. [12]
LumoProtonNot stated
Not stated as hardware-protected. Prompts are encrypted in transit to the model servers, which decrypt them to process them; no enclave is described. [13]

From each service’s own pages, read on 29 October 2026. Open a row for its words and sources.

03 · Open weights

Three of five run open-weight models by default

Undergrove, Lumo and Mistral’s Vibe run open-weight models by default; ChatGPT doesn’t say it does, and Claude’s models are closed. How good are open models? Their publishers report scores on the same public tests, below. Those are the publishers’ numbers, under the settings they state, not ours.

UndergroveUndergroveOpen-weight models
Yes. Every model offered is open-weight, and one small model can run in your browser. [14]
ChatGPTOpenAINot stated
Not stated as open-weight. OpenAI’s open-weight models are its separate gpt-oss family, which it calls its first since GPT-2. [15]
ClaudeAnthropicClosed models
No. Anthropic describes keeping its model weights encrypted and secured. [11]
Mistral VibeMistral AIOpen-weight models
Its default model, Mistral Medium 3.5, has open weights, under a modified MIT licence. [16]
LumoProtonOpen-weight models
Yes. Proton says Lumo is powered by open-source models, and names them. [8]

From each service’s own pages, read on 29 October 2026. Open a row for its words and sources.

04 · Open models’ published scores

What open models’ publishers report

Each score is copied from the publisher’s own model card, with the settings it states. Settings differ, so read across with care; the leaderboard has every score and source.

Kimi K393.5%maximum reasoning · Moonshot AI
DeepSeek V4.1 Flash90.9%maximum reasoning · DeepSeek
Gemma 4 31B84.3%Google
GPT-OSS 120B80.1%high reasoning · no tools · OpenAI
Llama 3.3 70B50.5%0-shot · chain of thought · Meta

Scores as each publisher wrote them, read on 30 October 2026.

How this was made

Five services, read from their own help, privacy and security pages, for their personal plans. Where a service’s pages don’t say, the report says “not stated” and doesn’t guess.
Undergrove is one of the five. Its column describes what our code does today; it hasn’t been independently assessed.
Benchmark scores are the publishers’ own, copied as written. We haven’t rerun them.
Nothing is estimated. A section that would need figures we don’t have isn’t in this edition.

Whether your chats train the next model is still a setting

Protection while a model reads is the rare claim

Three of five run open-weight models by default

What open models’ publishers report

How this was made

Sources