Loading story…
OpenAI’s opt-in Computer History feature in the ChatGPT for Mac app uses macOS Accessibility permissions to collect visible text and interaction data—including window titles, typed input, clicks, and application switches—and turn it into diary-like Markdown summaries for contextual assistance and automation. Unlike screenshot-based activity-recording tools, it captures text elements exposed by the operating system; raw events remain local for up to 48 hours before summaries are written to an application-accessible local directory and can be incorporated into ChatGPT conversations.
The plaintext summaries may expose sensitive work activity to anyone with local access to the Mac or to macOS-focused infostealer malware, while summaries used in chats can also be retained on OpenAI servers under normal chat and memory policies. Organizations should disable the feature for sensitive roles or tightly scope it, exclude private applications and websites, and enforce strong device login controls and full-disk encryption.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
OpenAI released the opt-in Computer History feature for the ChatGPT for Mac app. The feature, available to Pro subscribers and above, uses macOS Accessibility permissions to capture activity context and generate summaries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenAI has begun rolling out **Computer History**, an opt-in feature for the ChatGPT desktop app on macOS that records user interaction events including clicks, typing, keyboard shortcuts, app switches, and accessibility-exposed context to build a searchable timeline of activity across apps and websites. The capability is available to **Pro, Business, and Enterprise** users of ChatGPT Work and Codex, and is designed to let ChatGPT answer context-based questions and help locate files, documents, and conversations without relying on continuous screenshots, microphone capture, or system audio. OpenAI said the feature stores interaction history locally for up to **48 hours** and sends event data to its servers to generate memories, while stating that raw event files are not retained after processing unless legally required and are not used for model training. The company also warned that the local history files may contain sensitive information, are **not encrypted**, and can be accessed by other programs running under the same macOS user account; it further acknowledged increased **prompt injection** risk from malicious content embedded in websites or apps. Users can exclude apps and sites, pause collection, and delete local data, while Business and Enterprise deployments require admin approval and availability remains delayed or unavailable in the **EEA, UK, and Switzerland**.
Aug 24, 2026
OpenAI introduced **Lockdown Mode** and **Elevated Risk** labels in *ChatGPT* to reduce exposure to **prompt injection** and related data-exfiltration risks when AI features interact with external systems. Lockdown Mode is positioned as an optional, advanced setting for higher-risk users and environments (notably *ChatGPT Enterprise*, *Edu*, *for Healthcare*, and *for Teachers*) that restricts tool access and limits how ChatGPT can reach outside systems; reported controls include disabling or constraining capabilities attackers could abuse via conversations or connected apps, and limiting browsing so that no live network requests leave OpenAI-controlled infrastructure (with browsing constrained to cached content). Admins can enable the setting via workspace controls and apply additional restrictions through dedicated roles, while Elevated Risk labels provide in-product warnings and guidance for features that increase risk when connecting to apps or the web, including across *ChatGPT*, *ChatGPT Atlas*, and *Codex*. Separate research highlighted how AI assistants with web-browsing/URL-fetching features can be abused as stealthy **command-and-control (C2) relays**, demonstrating a technique against **Microsoft Copilot** and **xAI Grok** that tunnels operator commands and victim data through legitimate AI web interfaces and can work without an API key or registered account. In parallel, the **European Parliament** reportedly disabled built-in AI tools on lawmakers’ work devices due to cybersecurity and privacy concerns about uploading sensitive correspondence to third-party cloud AI providers and uncertainty about what data is shared and retained. Other referenced material focused on general productivity customization of ChatGPT via “Custom Instructions,” rather than a specific security event or disclosure.
Jun 29, 2026
Palo Alto Networks Unit 42 reported a newly identified forensic artifact in **macOS Tahoe 26.x** that records user menu selections in Apple’s Biome system. The artifact, named **`App.MenuItem`**, is stored at `~/Library/Biome/streams/restricted/App.MenuItem/local` and contains **SEGB**-encapsulated protobuf entries that preserve menu item text and timestamps. According to the report, the data can show deliberate actions taken through the user interface, including saving files, compressing folders, moving items to the trash, and emptying the trash. The finding gives investigators a new way to reconstruct user intent during incident response and digital forensics, particularly in cases involving suspected data theft or post-activity cleanup. Unit 42 said common commercial forensic tools do not yet parse the stream, but analysts can extract and convert the records for review using the open-source `ccl-segb` utility. The researchers cautioned that generic menu labels may not identify the exact file or folder involved, so the artifact is most valuable when correlated with other macOS logs and evidence sources.
Jun 29, 2026