ChatGPT Desktop App Tracks macOS Activity via Accessibility API

OpenAI’s latest update to the native macOS ChatGPT desktop app introduces an opt-in feature that builds a searchable timeline of user interactions across applications and websites. Announced on August 13, 2026, Computer History replaces the earlier Chronicle research preview and leverages the Codex coding tool to analyze recent activity. This system provides context recovery for tasks left half-done and suggests workflow automations based on repeated user behaviors.

Event Capture and Local Processing

Unlike Chronicle, which relied on continuous screenshots, Computer History hooks into macOS accessibility features to record discrete interaction events. The system tracks clicks, keyboard shortcuts, app switching, and reads text already typed. It does not function as a raw keylogger.

The ChatGPT app captures these interaction events locally. Periodically, the application initiates an ephemeral Codex session to process the raw event stream into text summaries and discrete skills. Raw interaction files are processed on OpenAI servers but are not retained for more than 48 hours and are excluded from model training pipelines.

The resulting memory files and summaries are saved locally on the host machine in Markdown format. If you build systems that rely on long-term agent memory, this architectural split between local storage and cloud processing represents a standard approach for mitigating high context window costs.

Availability and Application Scope

Computer History is strictly limited to the native macOS application. It is not currently available for Windows or Linux hosts. Access is restricted to ChatGPT Pro, Business, and Enterprise subscribers. Due to regulatory constraints, the feature is excluded from the European Economic Area (EEA), Switzerland, and the United Kingdom.

Feature Constraint	Detail
Target OS	macOS only
Required Tier	Pro, Business, Enterprise
Excluded Regions	EEA, Switzerland, UK
Default State	Off (Opt-in required)

Users can selectively filter which specific applications and websites contribute to the timeline. Collection can be paused directly from the macOS menu bar, and specific entries or generated summaries can be manually deleted from the settings menu.

Security and Exploitation Risks

Security researchers at Elephas identified that the local Markdown memory files generated by Computer History are not encrypted at rest. Any program running under the same macOS user profile can read the contents of these files. This local plaintext storage design mirrors earlier architectural decisions seen in Microsoft’s Windows Recall.

The continuous ingestion of web activity introduces a massive vector for prompt injection. If a user visits a website containing hidden, malicious instructions, the Codex agent processing the activity feed could parse and execute those commands during its summarization routine. Documentation explicitly warns that this feature increases the risk of indirect prompt injection attacks against the local environment.

If your organization deploys macOS fleet management, verify your endpoint detection rules around local ChatGPT app data directories before enabling this feature for internal users. You must isolate agentic tools from untrusted external web context to prevent automated execution of arbitrary instructions.