OpenAI's Computer History Turns Your Mac Into Agent Memory, and Writes It to Plain Text

What the feature actually captures, where the files land on disk, and the three sentences in OpenAI's own docs you should read before switching it on

OpenAI's documentation for Computer History carries a heading that most product pages would never survive legal review. The heading is "Prompt injection risk." Under it: "Computer History increases the risk of prompt injection from content in apps and websites."

That is the vendor, writing about its own feature, in the docs it expects you to read while enabling it.

A few paragraphs later, the same page gets more specific about what ends up on your disk. "Computer History files can contain sensitive information. They are not encrypted by Computer History, and other programs running as your macOS user may be able to access them."

I have read a lot of agent memory documentation this year. Almost none of it names its own failure modes in the vendor's voice. This one does, and the honesty is the reason to take the feature seriously rather than a reason to skip it.

Why this one matters more than the last three memory features

Agent memory has mostly been a server-side abstraction. Something gets stored somewhere you cannot see, retrieved by logic you cannot inspect, and injected into a context window you cannot audit. You either trust the vendor or you turn it off.

Computer History inverts that. The memories are plain-text Markdown files sitting in a directory on your laptop that you can open in any editor, read, and edit by hand. That is a real improvement in inspectability, and it is also the whole problem. A file you can read is a file other software running under your account can read.

So agent memory just became a file format with a security posture, on a machine you own, containing a summarized record of what you did all day. That is a new thing to reason about, and the reasoning is not hard. It just has to actually happen before you flip the switch.

The mechanism, which is better than the pitch suggests

The predecessor here was Chronicle, a research preview that worked by taking screenshots. Computer History is a rebuild, not a rename, and the rebuild changed the capture layer.

It takes no screenshots, no screen recordings, no microphone input, and no system audio. OpenAI states this twice on the same page, and adds the line that matters operationally: "Computer History does not require Screen Recording permission."

Instead it reads interaction events. In OpenAI's words, "Events can include clicks, typing, keyboard shortcuts, app switches, and context that macOS exposes through its accessibility system." Private-mode browsing "is never included."

That stream stays local while it accumulates. Then, periodically, the app "starts an ephemeral Codex session with access to the interaction-event stream to summarize your activity into memories." The summarization is not local. OpenAI's doc is direct about it: "OpenAI processes temporary event files on its servers to generate memories, which are then stored locally on your Mac."

The output lands at $CODEX_HOME/memories/extensions/skysight/, which for most people resolves to ~/.codex/memories/extensions/skysight/. The internal codename in that path is OpenAI's, not mine.

Here is the distinction that decides everything downstream, and it is easy to blur.

Raw event files are isolated inside the ChatGPT App Group, which per the docs "prevents other apps from accessing them without explicit permission." They are deleted after 48 hours.

Derived memory files are the ones under skysight/. They are not encrypted, other programs running as your macOS user may be able to read them, and they persist until you delete or clear them.

The protected class is the short-lived one. The permanent class is the exposed one. Anyone writing about this feature who says "the files are protected" or "the files are exposed" without splitting those two has gotten it wrong.

The part that loops back

There is one more sentence worth quoting in full, because it answers the question everyone asks second. "When ChatGPT or Codex uses a memory in a future chat, relevant memory contents and interaction events may be included as context. This chat content may be used to improve OpenAI models if allowed by your ChatGPT data controls."

So the memories are local at rest and not local in use. They go back up as context when they get retrieved, and what happens to them then depends on a setting in a different part of the product. OpenAI does say it deletes the temporary event files server-side after processing "unless required by law" and does not use those for training. The derived memories entering a later chat are governed by your data controls, which is a different promise.

The feature also does something genuinely useful with the stream. Per the docs: "When Computer History notices repeatable work, a timeline entry can suggest a skill or automation. Review the suggestion, then ask Codex to create it from the recorded workflow." That is the actual product idea. Not recall, but noticing that you did the same eight steps on Tuesday and Thursday and offering to write them down as something Codex can run. I think that framing is right, and it is the reason this is worth enabling at all rather than admiring from a distance.

Put this into practice

Before anything else, check whether you can even run it. It requires ChatGPT Pro, Business, or Enterprise; the macOS desktop app; and Memories switched on. It is not available in the EEA, Switzerland, or the United Kingdom, and OpenAI's changelog says only "initial availability excludes" those, with no timeline attached. It also does not work with an API key or Amazon Bedrock, so you cannot wire it into your own harness.

1. If you are on Business or Enterprise, an admin has to open the door first. Workspace Settings, then Permissions & roles, then Enable Computer History. OpenAI is careful that this is not the same as turning it on: "Granting workspace access only lets a member choose to turn on Computer History. It does not turn on the feature for anyone."
2. Enable it from Settings, Integrations, Computer history, Turn on. It is off by default, which the docs bold. You will walk through a privacy and permissions screen and any macOS prompts.
3. Set Permissions to an allowlist, not a blocklist, on day one. The settings pane offers four modes: exclude these apps, exclude these websites, include only these apps, include only these websites. Pick "include only these apps" and start with three: your editor, your terminal, one browser. You can widen it later. Widening is reversible in a way that a week of captured Slack is not.
4. Add your password manager, your banking app, and anything health-related to the exclusions anyway, as belt and braces. OpenAI recommends this itself, which is worth reading closely: the only automatic exclusion documented anywhere is private-mode browsing. Everything else is you, configuring it. The captured event set explicitly includes typing, and the docs describe no carve-out for password fields. I want to be careful here, because undocumented is not the same as absent. But in a page this detailed about privacy, that silence is the thing I would want answered.
5. Read your own memories on day two. Run ls ~/.codex/memories/extensions/skysight/ and open one file. If anything in there is something you would not paste into a group chat, you have learned exactly what your exclusion list is missing, and you have learned it from data rather than imagination.
6. Learn the pause before you need it. The ChatGPT icon in the macOS menu bar pauses and resumes capture. OpenAI's own guidance on other people's conversations is unusually blunt: "Turn it off during communications with other people unless you have their prior express consent."
7. Know the clear granularity. You can clear the last 10 minutes, hour, day, or everything. Clearing history also deletes the memories derived from it, and the docs say plainly: "This cannot be undone."

The ten-minute version of all of this: turn it on, restrict it to three apps, use it for a day, read the files, then decide how far to open it.

Honest limitations

The unencrypted derived memories are the headline, and no configuration fixes them. Any process running as your macOS user can read ~/.codex/memories/extensions/skysight/. That includes every npm postinstall script, every VS Code extension, and every random binary you curl'd into your path in 2024. If your threat model already accounts for that, this changes nothing. If it does not, this is the feature that should make you fix it.

The prompt-injection increase is real and vendor-acknowledged. The event stream can carry page content, so a website with hostile instructions is now a channel into a system that summarizes and later replays. OpenAI's example is deliberately plain: "if you visit a website containing malicious instructions, ChatGPT or Codex might follow those instructions."

Token cost is documented in exactly one sentence: "Computer History uses tokens while it summarizes activity and creates memories." No rate, no quota, no statement about how it interacts with your plan limits. Do not budget around a number, because there isn't one. If someone quotes you a per-day token figure for this feature, ask where it came from.

Availability is narrow. Three plan tiers, one operating system, three regions excluded at launch with no published timeline, and no API or Bedrock path. If you build agent tooling for a team spread across London and Berlin, this is currently a demo you cannot standardize on.

And the accessibility-permission question is genuinely open. The docs say it reads context macOS exposes through its accessibility system and that you should "follow any macOS permission prompts," but they never name the Accessibility permission directly. I would not state that requirement as documented fact until OpenAI writes it down.

What I would actually do

Turn it on, narrow, on a machine where you already know what is running. Give it your editor and terminal for a week and see whether the suggested skills are any good, because that is the only question that decides whether the tradeoff was worth making. Then open ~/.codex/memories/extensions/skysight/ and read what a week of you looks like when a model summarizes it.

That directory is the real artifact here. Not the timeline, not the suggestions. A folder of plain-text files describing your working life, sitting at the same permission level as everything else you run. OpenAI told you that in the docs. The part they left to you is deciding what else on your Mac gets to read it.

Sources: OpenAI, Computer History documentation; OpenAI docs changelog, entry dated 2026-08-13; 9to5Mac, "ChatGPT for Mac adds opt-in Computer History feature, replacing Chronicle"; The New Stack.