Chutes models are now on SayGM

SayGM is an LLM gateway built on Bittensor subnet 28. The gateway itself runs inside an Intel TDX trusted execution environment and with one API key and one base URL you get access to  Claude, GPT, Gemini and a varied catalog of open-weight models.

Chutes is happy to announce we are now one of the upstream providers powering access on SayGM. The open-weight models SayGM serves inside a TEE sit in its confidential tier, and you can spot them by the -tee suffix on the model ID.

If you build on Chutes directly, nothing about your setup changes. If you build on SayGM, you can now get a TEE-served open model and a closed frontier model from the same key.

Two subnets, two jobs

SayGM (subnet 28) runs the gateway. It accepts the request in the API shape your code already uses, then handles billing and picks which provider serves the call.

Chutes (subnet 64) is one of those providers. We run decentralized, serverless inference for open-weight models, and all of the models we currently serve run inside hardware-attested TEEs with end-to-end encryption. That is the leg we take over once a request reaches us.

SayGM’s routing is handled by independent inference providers on subnet 28, who carry traffic to the approved upstreams. Each one that routes to Chutes holds its own Chutes API key. SayGM states that all of those api keys remain safely sealed within a TEE rather than in a config file. From where we sit, an SN28 inference router is a Chutes customer and simply pays for what it uses.

What changes for you

Nothing, if you call llm.chutes.ai/v1 today. Your key, your endpoint and the catalog at llm.chutes.ai/v1/models stay as they are. That is also still where the full catalog lives, with image, audio, video and embedding models alongside the LLMs.

If you already route through SayGM, pick a model with the -tee suffix and SayGM serves it from inside a TEE. Add the header covered below and it runs on Chutes specifically. You get a confidential open model and Claude behind the same key, in the same code.

How a request travels

SayGM describes its side of the path like this:

1. Your app calls api.saygm.com. The request enters SayGM's gateway, which runs inside an Intel TDX trusted execution environment.
2. The gateway picks an inference provider with capacity for that model.
3. The provider forwards the request to Chutes using its own Chutes key.
4. The model runs inside a Chutes TEE, and the response streams back along the same path.

The first three steps are SayGM's to describe, and its privacy documentation does. The last one is ours, and it works the same for every request we serve, whichever door it came through.

Where the privacy comes from

A trusted execution environment (TEE) is a secure, hardware-isolated section of a processor. It protects code and data from the main operating system and outside attackers. No one can see what is processed inside, not even the people physically managing the server. . Attestation is how the machine proves to you cryptographically that it is running the code it claims to run.

On our side:

• Intel TDX encrypts the memory of each trust domain and takes the hypervisor out of the trust boundary.
• NVIDIA Protected PCIe encrypts the channel between CPU and GPU, so the prompt is covered on its way to the accelerator too.
• The disk key that lets a node boot into service is released only after attestation succeeds.

We wrote this up in our confidential compute post. The stack that does it (sek8s) is open source, so you can read the implementation instead of reading our marketing. If you want to go further, anyone can rebuild the production VM image on an ordinary Linux machine and compare its measurements against the ones we publish.

So there are two TEEs in the path. SayGM's gateway seals the request on the way in, and we keep it sealed while the model runs. Each one is checked on its own terms. You don't have to trust SayGM's word about our hardware, or our word about theirs.

There is one boundary worth stating plainly. We can vouch for what happens once a request reaches Chutes. For what happens before that, SayGM's privacy documentation sets out what each tier guarantees, and that is the document to hand an auditor.

Why we said yes

A large part of what makes Bittensor interesting is subnets being useful to each other, and not only to their own holders. This is the second time in a month we have plugged into another subnet's product. In September, SOMA (subnet 114) connected its agents to Chutes inference. SayGM now routes confidential-tier traffic to us, alongside its other TEE providers. In both cases the other subnet's users get Chutes inference inside a product they already use, and we get a door for builders who may never have found chutes.ai otherwise.

It also fits what we are here to do. We think you should own intelligence instead of renting it, and that running a model should not mean handing over your data. A gateway that puts a TEE-served open model next to Claude in the same dropdown turns that from a migration into a one-line choice.

Pin a request to Chutes

Most of the time you won't need to. SayGM's default routing picks across everyone serving a model. When you want Chutes specifically, one header does it:

curl https://api.saygm.com/v1/chat/completions \

  -H "Authorization: Bearer $SAYGM_API_KEY" \

  -H "Content-Type: application/json" \

  -H "X-GM-Providers: chutes" \

  -d '{

    "model": "<model-id-from-catalog>",

    "messages": [{"role": "user", "content": "gm"}]

  }'

The header takes a comma-separated list, and you can pair it with X-GM-Routing: cheapest or fastest to say how SayGM should choose among the providers you allowed. The full set of options is in SayGM's routing docs.

Pricing on SayGM is SayGM's. Its inference providers set their own discount against list price, and the live board is at saygm.com/miners. We don't set those numbers, so check them there.

Common questions

Do I need a Chutes account to use Chutes through SayGM?

No. The Chutes key belongs to the inference provider serving your request, so a SayGM key is enough. If you want the full catalog, or you would rather call us directly, sign up at chutes.ai/signup and point your client at llm.chutes.ai/v1.

Which models does this cover?

The ones SayGM lists with a -tee suffix, which it labels confidential tier. Our own catalog is live at llm.chutes.ai/v1/models. Model lists on both sides change often, so check on the day you decide.

Can the provider in the middle read my prompt?

For the Chutes leg, the TEE answers that. The operator running the hardware can't read what is inside it, and attestation lets you check that for yourself. For the gateway leg, SayGM's privacy documentation describes what its TEE protects and from whom.

Try it

Through SayGM: create a SayGM API key, list models with GET /v1/models, and send a request with X-GM-Providers: chutes.

Directly: create an account and API key at chutes.ai/signup, then call llm.chutes.ai/v1 from any OpenAI-compatible client. The chutes-agent-toolkit drops the same TEE inference into Claude or any OpenAI-compatible client, and we ship Vercel AI SDK and n8n integrations if that is where you build.