By ByteBot
OpenAI launched Computer History on August 13 — an opt-in Mac feature that watches your clicks, keystrokes, and app switches, then distills them into persistent ChatGPT memories. Those memory files live on disk as plain-text Markdown, unencrypted, readable by any process running under your user account. OpenAI acknowledges this in its own documentation. With Mac infostealers increasingly active in 2026, that is a concrete risk worth understanding before you enable it.
What Computer History Actually Does
Computer History uses macOS accessibility APIs to record interaction events — clicks, typing, keyboard shortcuts, and app switches. It does not capture screenshots, screen recordings, or audio. Raw event files are stored locally and deleted after 48 hours. What persists are synthesized summaries: plain-text Markdown files that group your activity by app and context, noting which tools and websites contributed to each session. These summaries remain on disk indefinitely until you manually clear them.
The feature is off by default and requires explicit opt-in through Settings > Integrations > Computer History. It’s available to Pro, Business, and Enterprise subscribers in the US. Users can exclude specific apps and sites — so you could allow your code editor while blocking your bank and personal email.
The Storage Problem Is Real
“Computer History files can contain sensitive information and are not encrypted. Other programs running under the same macOS user account may be able to read them.”
OpenAI documentation
That is not an edge case caveat. Any process running as your user — a browser extension, a malicious package, a remote access tool, or an infostealer — can read those files without elevated privileges. Mark Beare at Malwarebytes put it plainly: these files give attackers “a ready-made map of someone’s workday.”
The Mac infostealer landscape is not theoretical in 2026. Atomic macOS Stealer, Infiniti Stealer, and ClickFix-deployed payloads are actively targeting Mac users. Their standard exfiltration method is a curl POST to a command-and-control server — plain-text files require no additional decryption step. A structured Markdown summary of your recent workflow is exactly the kind of organized, readable intelligence that makes infostealers valuable.
Developers Face a Higher-Stakes Version of This Problem
Computer History feeds context directly into Codex. OpenAI’s own announcement framed it this way: “Codex and ChatGPT can now understand the context of your recent work. Opt into Computer History to give ChatGPT richer context, so it can pick up where you left off, understand patterns in your work, and suggest skills or scheduled tasks for work you repeat.”
In practice, a developer’s memory file could accumulate repository names, internal tooling patterns, CI/CD pipeline details, client project names, and API interaction logs from terminal use. Apple’s deeper Xcode integration in Xcode 26.3 widens that scope further. The feature that makes Codex smarter also concentrates sensitive workflow intelligence into a single unencrypted file.
There Is Also a Prompt Injection Pathway
Computer History summarizes content from websites you visit while it’s active. A malicious site could embed instructions designed to survive the summarization process and land in persistent memory. If ChatGPT or Codex later treats that memory as trusted context — which is the entire point of the feature — the injected text can influence future coding sessions or responses.
This isn’t speculation. OWASP designates prompt injection as LLM01:2025, its highest-priority vulnerability class for LLM applications. Palo Alto’s Unit 42 research found attack success rates between 80% and 99.8% against agent implementations, with LLM-based detectors missing 66% of poisoned memory entries because the malicious content appears benign in isolation.
The Microsoft Recall Comparison Writes Itself
Microsoft Recall took screenshots. Computer History records keystroke events. The mechanism differs; the storage architecture is the same: local, unencrypted, summarized into a persistent file. Recall was pilloried in 2024, delayed, eventually rebuilt with encryption and made fully opt-in after backlash. Computer History launched opt-in by default, which is better — but the underlying storage vulnerability hasn’t been addressed.
Help Net Security’s analysis was direct: feeding a model this much running context raises the chance of prompt injection — and the plain-text storage is an attack surface that doesn’t require compromise of OpenAI’s infrastructure. The threat comes from whatever is already on your Mac.
What to Do
If you haven’t enabled Computer History, the simplest protection is to leave it off. If you’re curious about the feature but work on sensitive projects, these steps reduce your exposure:
- Exclude the terminal, password managers, banking apps, and any app where sensitive credentials might appear.
- Review and clear memory regularly: Settings > Integrations > Computer History > Delete All.
- Run a Mac-targeted infostealer scan (Malwarebytes for Mac or Jamf Threat Defense).
- Do not treat Computer History as safe just because it’s opt-in — the opt-in is the only protection right now.
OpenAI may add encryption in a future update — the Recall precedent suggests that public pressure eventually moves the needle on these decisions. Until it does, read the official documentation carefully before deciding whether the workflow benefits justify storing your entire development context in a plaintext file.
