Skip to content
NewsProduct launch

OpenAI releases ChatGPT Computer History for Mac, discloses unencrypted storage and prompt injection risk

· by Pondero Newsdesk

The short version

OpenAI shipped ChatGPT Computer History on August 17, an opt-in macOS activity tracker for Pro, Business, and Enterprise users. The feature records interaction events locally but ships with OpenAI's own warnings about unencrypted memory files and prompt injection exposure.

OpenAI releases ChatGPT Computer History for Mac, discloses unencrypted storage and prompt injection risk

The same day OpenAI launched Computer History, its new macOS activity tracker for ChatGPT and Codex, it published its own security warning: the memory files sit on disk as plain text, readable by any script running under the same user account. A second disclosure on the same page warned of prompt injection exposure. Both came from OpenAI's product documentation on August 17, before any external researcher had published an analysis.

What the feature does

Computer History records interaction events across user-permitted applications and websites, including Google Docs, Slack, and browser tabs. Those events convert into structured memories that ChatGPT and Codex can reference when answering questions like "what was I debugging yesterday?" Per TechRepublic, citing OpenAI's announcement, the feature captures clicks, typing, and application switching, but explicitly excludes screenshots, screen recordings, microphone input, and system audio. Private browsing sessions are excluded automatically.

Temporary event files remain on the device for up to 48 hours. Generated memory files persist locally until users delete them.

Access requires ChatGPT Pro, Business, or Enterprise on macOS. Business and Enterprise administrators must grant permission before individual employees can enable it. Currently the feature is unavailable in the European Economic Area, Switzerland, and the United Kingdom.

The risks OpenAI named on launch day

OpenAI disclosed two security issues in its product documentation on August 17.

First, memory files are stored as plain text and are not encrypted by Computer History. Per Yahoo Tech, citing OpenAI's support documentation, other programs running under the same macOS user account can read those files. Any script or malware operating as the current user gains access to the accumulated log of recent activity without any privilege escalation.

Second, Computer History expands the surface for prompt injection. A malicious instruction embedded in a permitted website or application could enter the ChatGPT or Codex context alongside legitimate activity memories. OpenAI's documentation states the risk directly: "if you visit a website containing malicious instructions, ChatGPT or Codex might follow those instructions." That disclosure came from OpenAI, not from external researchers.

Why this matters for AI-tool operators

Teams using ChatGPT for Business on shared macOS hardware face the plaintext issue most acutely. On a machine where multiple scripts or tools run under the same user, the memory file is readable without elevated permissions.

Computer History feeds permitted-site content into the context of ChatGPT and Codex on a continuous basis. Unlike a standard chat session where the user reviews each message before sending, this feature processes permitted-site content as the user browses. An attacker who controls a site a user visits, or a malicious dependency inside a permitted app, could insert instructions targeting the Codex agent layer.

Microsoft's Windows Recall drew significant backlash in 2024 over screenshot-based storage of sensitive content. Computer History avoids screenshots entirely, which limits visual-data exposure. Plaintext memory storage and the prompt injection surface are separate problems that the no-screenshot design does not address.

What to watch next

OpenAI named prompt injection as a risk on day one, before any external proof-of-concept appeared. Whether security researchers publish a working exploit through the new memory surface will be the first indicator of how quickly enterprise administrators need to respond. Computer History launched without access in the EEA, Switzerland, or the UK. The EU AI Act's Article 50 transparency obligations took effect August 2, three weeks before the feature shipped.

Sources