Cocoon, short for Confidential Compute Open Network, is a network that lets owners of server GPUs run AI models for paying clients inside hardware-protected virtual machines, with payments settled on the TON blockchain. Telegram's founder Pavel Durov announced it live on November 30, 2025, and Telegram's January 3, 2026 update used it to power AI summaries. The privacy claim rests on hardware attestation, and that hardware has known limits.
Key takeaways
- Cocoon has three roles: clients that pay for requests, proxies that route them, and workers that run the model on GPUs.
- Per its documentation, proxies and the on-chain registry were still operated by the Cocoon team when read on October 27, 2026.
- Workers need NVIDIA H100-class or newer GPUs with confidential computing support; consumer RTX cards are not supported for production.
- Researchers showed in 2025 that a physical memory-bus attack can defeat Intel and AMD confidential computing, which Intel and AMD treat as out of scope.
- Usage figures, node counts, and independent audits could not be found in primary sources.
What was announced and when
Durov presented Cocoon at the Blockchain Life 2025 conference. On November 30, 2025, he posted on his Telegram channel that the network was live, that the first AI requests from users were being processed "with 100% confidentiality," and that GPU owners were already earning TON. He said the next weeks would bring more GPU supply and more developer demand.
The first visible product use came on January 3, 2026. Telegram's release notes for that update describe AI summaries of long channel posts and Instant View pages, "powered by open-source models running on Cocoon." The notes add that each request is encrypted. That statement is Telegram's own description; no independent test of it was found.
Three roles and who runs them
The project's public repository holds the code under the Apache-2.0 license and a set of technical documents. The architecture document describes the parts below. The last column reflects the text read on October 27, 2026, and the project says parts of it are meant to change.
| Part | Job | Who runs it, per the documents |
|---|---|---|
| Client | Library that sends requests and pays; checks the proxy's attestation | Intended for server back ends, such as Telegram's own |
| Proxy | Picks a worker by model, load, and reputation; takes payment; pays the worker; keeps a commission | The Cocoon team; the documents say anyone will be able to run one in future |
| Worker | Runs the model on a GPU inside a confidential virtual machine | GPU owners, who register with a TON wallet address |
| Root contract | On-chain registry of approved software image hashes, model hashes, and proxy addresses | The Cocoon team; the documents say a DAO is planned |
So the network is open on the supply side but still centrally coordinated on the routing and governance side.
What the privacy claim depends on
Both proxies and workers run inside trusted execution environments (TEEs), which are CPU features that encrypt a virtual machine's memory so the machine's owner cannot read it. The documents name Intel TDX and AMD SEV-SNP. Each virtual machine produces a signed measurement of the software it booted. Before a request moves, the client checks the proxy's measurement against hashes stored in the root contract, and the proxy does the same for the worker. Software images are meant to be reproducible, so anyone can rebuild them and compare checksums.
GPUs add a second layer. The GPU document sets a minimum of NVIDIA H100 with confidential computing mode, lists the H200 NVL as tested, and says consumer RTX cards are not supported for production. Its own security notes state that GPU attestation does not prove the absence of timing or power side channels.
Where the guarantee stops
A TEE protects against a hostile operating system or hypervisor. It does not fully protect against someone with physical access to the server, and a Cocoon worker is, by design, a machine owned by a stranger. In October 2025, researchers from Georgia Tech, Purdue, and van Schaik LLC published TEE.fail, a DDR5 memory-bus interposer they estimate costs under USD 1,000. They used it to extract attestation keys from Intel TDX and AMD SEV-SNP systems and to forge attestations, including for NVIDIA GPU confidential computing. The paper is listed for IEEE S&P 2026. According to the researchers, Intel and AMD consider interposer attacks out of scope for their products.
The Cocoon documents read for this article list side channels as a residual risk but do not mention this specific technique. Whether and how the network addresses it could not be confirmed. A practical reading: the design strongly limits what a remote, software-only attacker can see, and it asks users to trust the physical security of whoever hosts the worker plus the hardware vendors.
How payment works
Clients prepay a proxy through a smart contract on TON and stake a small amount used to decide how often they are charged. The proxy pays workers for completed requests. Because each on-chain operation costs roughly 0.01 TON, the documents say parties normally hold signed payment messages and commit them to the chain only occasionally. The documents describe pricing as a price per token, where "token" means a unit of text rather than a cryptocurrency.
This article describes mechanics only. It makes no statement about the value of TON, offers no view on earning from GPU hosting, and is not financial advice.
Questions to ask before relying on any confidential AI service
- Who operates the routing layer, and who can change the list of approved software?
- Which hardware generation is required, and what do the vendors say about physical attacks?
- Has anyone outside the project audited the attestation and payment code?
- Are prompts also logged by the application that calls the network?
FAQ
Is Cocoon a Telegram feature or a separate network?
Both. It is a separate network with open documents and a public repository, and Telegram is its first major client, using it for AI summaries since January 3, 2026.
Can anyone with a gaming GPU join as a worker?
Not under the documented requirements. The GPU document asks for H100-class or newer data center cards with confidential computing and says consumer RTX cards are not supported for production.
Does confidential computing mean nobody can see a prompt?
It means the server owner and the host software are not supposed to. The hardware vendors' own threat models exclude physical memory-bus attacks, and the client application that sends the prompt can still read it.
Is the code open source?
The repository carries the Apache-2.0 license text. Network operations, such as the proxies and the registry, were still run by the Cocoon team when the documents were read.
Related reading
- How bots work inside Telegram
- AI and Ethereum-based decentralized systems
- DeepSeek models and services
- How a neural network processes data
More in AI Tools and Industry.
Last verified: October 2026
Sources
- COCOON architecture, smart contracts, TDX and images, and GPU documents, TelegramMessenger/cocoon repository, read October 27, 2026
- Pavel Durov, post announcing Cocoon is live, Telegram channel, November 30, 2025
- AI Summaries, New Design and More, Telegram blog, January 3, 2026
- TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition, Chuang et al., 2025