Why ChatGPT Computer History Could Be a Target for Mac Infostealers

Computer History is designed to help ChatGPT and Codex pick up where a Mac user left off. That convenience also creates the security concern raised in September 2026: a readable summary of activity across selected apps and websites could give an infostealer valuable context if it gains access to the user’s files.1212

What Computer History records

OpenAI introduced Computer History for the ChatGPT macOS app on August 13, 2026. It uses interaction events from selected apps and websites to provide context for later work in ChatGPT and Codex.1 Reporting describes those events as including clicks, typed text, keyboard shortcuts, app switches, and context exposed through macOS Accessibility APIs. OpenAI says the feature does not capture screenshots, screen recordings, microphone input, or system audio, and excludes private browsing.81

The distinction matters: not taking pictures of the screen does not mean the resulting record is harmless. Text and interface context from an allowed workflow may still reveal what someone was working on.812

Where the infostealer risk arises

Reports describe temporary interaction-event files on the Mac for up to 48 hours. OpenAI processes events on its servers to generate memories; according to reporting on its stated policy, it does not retain those temporary event files after processing unless required by law and does not use them for training. Generated memories are a separate category: they are described as local, unencrypted plain-text Markdown files that remain until deleted.4232

Reporting identifies ~/.codex/memories/extensions/skysight/ as a location for the generated memories.412 A malicious process with sufficient access under the same macOS account may be able to read such files, subject to the permissions and restrictions that apply to it. The 48-hour window for raw events should therefore not be mistaken for a 48-hour lifetime—or an encryption guarantee—for the summaries.1242

This is an additional target after compromise, not evidence that Computer History itself installs malware. Microsoft documented macOS campaigns delivering infostealers including AMOS, MacSync, and DigitStealer through deceptive downloads and instructions to paste commands into Terminal. Those findings establish a relevant threat environment, but the cited sources do not show those families stealing Computer History files specifically.582

There is a separate, potential prompt-injection concern: if malicious website content enters a memory, it could affect a later AI response if treated as an instruction rather than untrusted material. The provided reporting raises the risk, not a demonstrated Computer History exploit.9

Who can use it—and what to check first

Computer History is off by default and requires Memories. It is documented for Pro, Business, and Enterprise users; Business and Enterprise members also need workspace-administrator enablement before opting in.18128 Some launch coverage said the EEA, Switzerland, and UK were excluded, but later OpenAI release notes say the feature is available there for those tiers. The launch-era restriction is not a reliable statement of current availability.918128

If you enable it, limit collection to the apps and websites you need, keep confidential workflows out of scope, and check what pausing or deleting history does to memories already generated. For legal, medical, or financial work, leaving it disabled until its handling meets your organization’s requirements is a reasonable choice. FileVault and screen-lock policies are useful safeguards, but neither should be treated as a remedy for malware already running with access to your logged-in account. And never run a website’s purported “verification” command in Terminal merely because the page asks you to.11255