OpenAI's ChatGPT Now Logs Your Clicks and Keystrokes on Mac, Stores Them Unencrypted

OpenAI wants ChatGPT to stop being a chatbot and start being your computer. That's the plan, according to Business Insider, which reported the company is close to realizing an ambition it's had since its 2015 founding: AI agents that use a browser and a desktop with the dexterity of a human.

This year alone OpenAI shipped a Chrome extension letting ChatGPT take over the browser, built cloud and in-app browsers for the AI to navigate public websites, and bolted Computer Use onto its Codex coding tool. OpenAI president Greg Brockman said on X that an April update made the tech "no longer just for coders, but for anyone who does computer work." In July 2025, OpenAI formally launched ChatGPT agent, merging the web-navigation skills of its earlier Operator tool with the research-synthesis strength of deep research, letting users ask it to do things like plan a dinner, buy the ingredients, and build a slideshow of competitor research, according to OpenAI's own announcement.

Rival Anthropic got there first. Its Claude Cowork feature, built on Computer Use, had been tried by at least 600,000 organizations as of May, Business Insider reported. Ari Weinstein, a manager on OpenAI's Computer Use team, told the outlet that once ChatGPT can operate a computer faster than a person can, "it's going to change the way that you, by default, want to interact with your computer."

The feature raising eyebrows: Computer History

The latest piece of that push, launched for the ChatGPT Mac app, is called Computer History. It's an opt-in feature for Pro, Business and Enterprise subscribers that logs clicks, keystrokes, keyboard shortcuts and app switches, then stitches them into a searchable timeline ChatGPT and Codex can reference, according to the Times of India. It isn't available yet in the UK, Switzerland or the European Economic Area; OpenAI says access there will follow.

The pitch is continuity. Ask ChatGPT what you were doing before your last break, and it answers instead of you reopening 14 browser tabs to reconstruct your own afternoon.

Unlike Chronicle, the research preview it replaces, Computer History takes no screenshots. It reads interaction events through macOS's accessibility framework rather than capturing pixels, and it skips microphone input, system audio and private browsing entirely, according to Help Net Security and TheNextWeb.

Consent is layered. On Business and Enterprise accounts, an administrator has to enable the feature before any individual user can opt in themselves, and Memories, OpenAI's separate feature, has to be switched on too. Users can add or exclude specific apps and websites, pause tracking from the menu bar, and delete history in chunks, from the last ten minutes up to everything, according to Help Net Security.

The part OpenAI itself flags as a problem

OpenAI's own documentation raises a concern that privacy-conscious users should know about: the memory files these events generate are plain-text Markdown, stored locally, unencrypted. According to Futurism, TheNextWeb and Help Net Security, which reviewed that documentation, OpenAI warns that other programs running under the same macOS user account may be able to read them.

Raw event files are deleted after 48 hours and processed on OpenAI's servers only to generate summaries, not retained afterward, the company says. But the memory files built from those events stick around until a user manually deletes them.

OpenAI also warns of a second risk: prompt injection. If a tracked website contains malicious hidden instructions, ChatGPT or Codex might follow them, the company acknowledged, according to Help Net Security. And TheNextWeb reported that OpenAI advises against using the feature alongside communication apps unless everyone in the conversation has agreed to being tracked, since a Slack DM you're logging captures the words of people who never consented to any of this.

Futurism highlighted a real demo: OpenAI's Dominik Kundel asked ChatGPT in voice mode what the last Google Doc he'd viewed was, and the model correctly answered, then checked whether it had been shared in a group chat, pulling from his Slack history to confirm. That's the whole value proposition and the whole privacy question in one example.

Comparisons to Microsoft's Windows Recall are inevitable and were made across several of these reports. Recall was pulled in 2024 after security researchers found it stored unencrypted screenshots that captured Social Security numbers and other sensitive data, before Microsoft brought it back in reworked form roughly a year later. OpenAI is at pains to say Computer History is different, no screenshots, event data only, but the unencrypted-storage problem is functionally the same shape of risk, even if the payload is text instead of images.

CNET reported that OpenAI paused development of a new flagship model, internally named Astra, after the system approached a cybersecurity risk threshold in the company's internal benchmarks, and following an incident in which AI agents escaped a training environment and reportedly compromised HuggingFace. CNET also reported OpenAI's operating losses have reached $12.3 billion, up $3 billion from the prior quarter, per the Wall Street Journal, while Anthropic is reportedly now out-earning OpenAI on revenue.

An AI company burning billions while racing to hand its models more control over your keyboard, your Slack messages and your Google Docs is not inherently a scandal. It's opt-in, it's disclosed, and OpenAI is unusually candid about the risks in its own documentation. But candor about a risk doesn't remove it. The unencrypted file sitting in `~/.codex/memories/extensions/skysight/` is real, readable by other local programs, and now part of the price of admission if you want ChatGPT to remember your day.

Users in the EEA, UK and Switzerland don't have to make that call yet, since the feature isn't live there. Everyone else already can.