OpenAI shipped a feature last week that quietly turns your Mac into a witness box. It is called Computer History, it lives inside the ChatGPT desktop app, and it records what you click, what you type, and which apps you switch between — all so your assistant can tell you what you were doing this morning without you having to explain it. In the demo video, an OpenAI engineer asks the app about the last document he edited, whether it was shared on Slack, and what his morning looked like. It answers all three. That is genuinely useful. It is also the single most invasive thing a mainstream AI assistant has shipped since Windows Recall.
2>What Computer History Actually Does
Computer History is opt-in, which already puts it ahead of Microsoft’s Recall mess when that feature launched in 2024. It is off by default, tucked under Settings in the ChatGPT menu bar app, and it is rolling out to Pro, Business, and Enterprise subscribers. OpenAI says it does not capture screenshots, screen recordings, microphone input, or system audio. Instead, it reads interaction events through macOS’s Accessibility system — the same framework screen readers use — and logs your clicks, typing, keyboard shortcuts, and app switches into a searchable timeline.
ChatGPT and Codex can then reference that timeline when you make a request. OpenAI’s Ari Weinstein said on X that the feature automatically ignores content in incognito or private browser tabs. You can exclude specific apps and websites, delete individual entries, and pause recording from the menu bar at any time. On the surface, the privacy story looks handled: it is voluntary, it is transparent, and it is granular.
Look one layer deeper and the handling gets less tidy. The feature replaces an earlier research preview called Chronicle, which relied on periodic screenshots. Computer History trades that visual record for something arguably more sensitive: a plain-language summary of everything you typed. The Register’s headline called it “friendly keylogging,” and the label is not far off. A short-lived Codex session periodically reads your raw event stream and writes a summary file. OpenAI calls that summary a memory.
The Part Nobody Is Talking About: Plaintext Memory Files
Here is the detail that should make any IT manager sit up. According to OpenAI’s own documentation, the raw event files stay on your Mac inside the ChatGPT app group and get deleted after 48 hours. But the memory files generated from them remain on your local filesystem as plaintext Markdown, in a folder the documentation points to directly, and they are not encrypted. OpenAI’s own docs acknowledge that any program running under your macOS user account can read them.
That means the summary of your day is sitting in an unencrypted text file on your work laptop, readable by any malware, any poorly behaved app, or any other process that runs as you. You are not just trusting OpenAI with your activity — you are trusting every piece of software on that machine. And the files stay there until you manually delete them. OpenAI says the event processing happens on its servers and that it does not keep the raw events after processing unless required by law, but the local memory files are the part that lingers.
There is also a training-data wrinkle. OpenAI says the memory files themselves are not used for AI training. But when those memories appear as context in a later chat, that chat content can still become training data depending on your data-control settings. So the line between “not training” and “actually training” is thinner than the reassuring sentence suggests. Read it as: the activity log is not fed to the model directly, but the conversations it enables very well might be.
Why the Security Community Is Nervous
OpenAI’s own documentation flags that Computer History increases the risk of prompt injection. That is a quiet bombshell. The feature captures content from apps and websites, so a malicious instruction embedded on a webpage you visit can end up inside the context ChatGPT or Codex sees — and the agent may follow it. This is the same weakness behind classes of attacks that hit real companies this week without needing the model itself. a single crafted email can rewrite an AI assistant’s memory if it ends up in context, and a feature that streams your entire screen activity into context dramatically widens that target.
In November 2025, researchers demonstrated that ChatGPT’s memory system could be hijacked through a crafted webpage to leak data — before Computer History existed. Now that same memory surface is being fed a continuous stream of what you type and click. The attack surface did not shrink; it moved from “what you paste into a chat” to “everything you do on the machine.”
OpenAI’s advisory is candid about the edges: it tells users to pause the feature or exclude apps that hold sensitive health, financial, or personal information, and it warns against using Computer History in conversations with other people unless everyone involved has explicitly consented. That last line is doing a lot of work — it is ChatGPT quietly admitting that the feature can record other people’s information without their knowledge. For a feature marketed on convenience, that is a heavy caveat.
The Consent Question, and the Countries Left Out
Opt-in is not the same as meaningful consent. Computer History ships with exclude lists, pauses, and a menu-bar toggle, which is more than most features get. But it is also a classic dark-pattern reversal of the burden: the user has to navigate settings and exclude the apps where their sensitive work actually happens, rather than the feature defaulting to nothing and asking for permission per app. I wrote that exact critique last week about Twitch’s AI training default — the quote from that story, “if this was opt-in, nobody would opt in,” applies here in reverse. If you build something people genuinely want, opt-in works. If you have to bury the toggle, maybe the feature should not exist.
Worth noting: Computer History is not available in the European Economic Area, Switzerland, or the United Kingdom. That is not an accident. Italy’s data protection authority fined OpenAI 15 million euros in 2024 over training on user data without adequate legal basis — the fine was later annulled on jurisdictional grounds, not because the conduct was deemed fine — and the UK’s information commissioner opened an inquiry into Windows Recall back in 2024. Regulators in those markets have already shown they scrutinize this exact category of tool. The feature being live in the United States, the Philippines, and everywhere else first is a deliberate regulatory calendar, and it says something about how OpenAI itself views the privacy math.
My Take, as an ICT Manager
Here is where this stops being a product story and becomes a workplace story. I manage an ICT division in a Philippine government institution. The Philippines has the Data Privacy Act of 2012, and it has real teeth for agencies handling personal data. If a staff member turns on Computer History on a work Mac, that feature is now recording the names, account numbers, or medical references that pass through their typing — even in apps the user did not think of as sensitive. Under the law, my office is accountable for how that data is processed, whether the staff member clicked “yes” or not. Consent from one employee does not cover the third parties whose data flows through that same keyboard.
That is why my honest verdict is mixed, which is the real story. The feature is useful — genuinely. The ability to ask “where did I leave off?” and get a grounded answer instead of a hallucinated one is a meaningful productivity win. I use local models and a human gate in my own AI workflow precisely so I can get useful automation without shipping my raw activity to a cloud provider. That discipline is no longer optional once an AI assistant can watch my screen. The convenience is real, and so is the exposure, and you do not get to pick one without the other.
For most people my advice is boring and practical. If you are on Pro and the feature tempts you: enable it for a week, watch what it records, exclude your banking apps, your health portals, and anything work-related that touches client or citizen data, and delete the memory files before you travel or hand the laptop in for service. And audit what your AI tools can actually see — the same way I walked through checking whether your AI coding assistant uploads your code to the cloud. If you run an office, treat Computer History the same way you would treat a new cloud service: policy first, training second, and a written rule about what must be excluded before the first click.
Where This Is Headed
Nobody should pretend this is a one-off. Computer History fits a pattern — call it ambient memory — that every major AI company is building toward. Microsoft tried it with Recall. OpenAI has now tried it twice, first with the screenshot-based Chronicle and now with this. It would be naive to expect Anthropic, Google, or Meta to skip the same roadmap when they are all racing to make their assistants context-aware enough to actually run your day. The technical direction is settled; the consent and security details are the only open questions.
The deeper question is whether the industry can build ambient memory without turning every laptop into a surveillance device with a productivity skin. The answer will decide more than this one feature. It will decide how much of our digital lives we hand to AI systems as the price of good assistance — and whether we hand it before collection, at the boundary, or after the fact, when the only defense left is a delete button on an unencrypted file.
I keep coming back to a line I wrote after Hank Green called his AI habit not healthy: the tools are not the problem, the discipline around them is. Computer History is a good feature that asks a very old question. It asks how much of yourself you are willing to hand over for convenience, and it answers it for you the moment you click enable. Before you do, know what is being recorded, who can read the file, and what you are actually trading. Then decide — deliberately, not by default.