AI Governance Institute
← News
Corporate Policy2026-08-14

OpenAI's Computer History Feature Brings Keylogging and Prompt Injection Into Enterprise Scope

What happened

OpenAI released Computer History, an opt-in feature for ChatGPT Pro, Business, and Enterprise subscribers on macOS that continuously captures keystrokes, mouse clicks, keyboard shortcuts, and application context to construct a persistent AI memory timeline. Unlike earlier screen-capture approaches, the feature avoids screenshot surveillance but instead logs granular input events, which are stored in unencrypted local files for up to 48 hours before being transmitted to OpenAI servers for summarization. OpenAI's own documentation warns that those local files are accessible to other processes on the same machine, and the company explicitly flags that the feature expands the attack surface for prompt injection. For Business and Enterprise deployments, the feature requires explicit admin approval before any employee can enable it, giving IT and compliance teams a configuration gate to control. The feature is currently blocked from availability in the EEA, Switzerland, and the UK, a jurisdictional carve-out that signals anticipated friction with regional data protection frameworks.

Why it matters

  • ·Unencrypted local storage of keystroke-level data means that any malware, unauthorized process, or co-tenant application on a managed device can access highly sensitive interaction logs before they are transmitted, creating a data breach exposure that sits outside traditional DLP and CASB controls, as noted in the CASB and DLP Cannot See Inside AI Prompts analysis.
  • ·OpenAI's own acknowledgment that Computer History expands the prompt injection attack surface adds a concrete new dimension to an already growing enterprise threat category, requiring compliance teams to update their OWASP Top 10 for Large Language Model Applications risk assessments for any deployment of this feature.
  • ·The jurisdictional block across the EEA, Switzerland, and the UK signals regulatory exposure under regional data protection rules; organizations with operations in those territories must verify that any ChatGPT Enterprise configuration explicitly prevents Computer History from activating for users in those regions, as inadvertent enablement could trigger cross-border data transfer and consent compliance failures.

Governance controls affected

SEC-001Prompt Injection PreventionAGT-002Agent Prompt Injection DefenseDGC-002PII Handling in AI SystemsDGC-005Cross-Border Data Transfer Controls for AISEC-003Sensitive Data Handling in AI Pipelines

What to do now

  • ☐Audit your ChatGPT Business or Enterprise admin console to confirm Computer History is disabled by default and establish a documented approval process before any enablement is permitted.
  • ☐Update your data classification and acceptable-use policies to specify that keystroke-capture AI features require a formal data privacy impact assessment before deployment.
  • ☐Verify that device management controls on all macOS endpoints used with ChatGPT restrict unauthorized process access to local application data directories where Computer History files are stored.
  • ☐Expand your prompt injection risk assessment to cover Computer History's input-capture pipeline, including any third-party applications running alongside ChatGPT on the same device.
  • ☐Confirm that Computer History is blocked for all users located in the EEA, Switzerland, and the UK through regional admin profile configurations, and document that confirmation for audit purposes.

What to watch next

Compliance teams should monitor whether data protection authorities in the EEA, UK, and Switzerland issue formal opinions on Computer History's data capture model, particularly regarding lawful basis for processing and cross-border transfer mechanisms. OpenAI has not yet indicated when or whether the feature will be made available in those jurisdictions, so any future rollout announcement should trigger an immediate review of vendor contract terms under existing EU AI Act and regional privacy obligations. Teams should also track whether the feature is extended to Windows or other platforms, which would materially change the device-security and data-exposure perimeter that current assessments are based on.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-09-21

Meta Muse Zero-Day Turns AI Agent Permissions Into an Endpoint Attack Pivot

Security researcher Patrick Wardle disclosed a local zero-day in Meta's Muse macOS AI assistant that lets an unprivileged local process redirect dictation traffic to an attacker-controlled endpoint. The flaw can expose authentication material, enable prompt injection, and abuse any OS permissions the user has granted to the app. No patch has been confirmed, and conventional endpoint detection tools cannot reliably distinguish the resulting malicious traffic from legitimate app behavior.

Research2026-09-19

BragJack Attack Turns Browser Extensions Into AI Agent Hijack Tools

Security researcher Gal Weizman disclosed a new attack class called BragJack, showing how a single malicious browser extension can seize control of AI agents in Chrome, Edge, Perplexity Comet, Opera Neon, and Claude for Chrome. Using a native browser mechanism, attackers can force hijacked agents to read local files, capture screenshots, access browsing history, and send emails on behalf of victims. Enterprise compliance programs are directly affected because the attacks exploit privileged AI agent access, not conventional malware, complicating detection and existing endpoint controls.

Research2026-09-19

Steganographic Attack Chain Turns Coding Agents Into Their Own Exploiters

Adversa AI's September 2026 security roundup documents a novel attack in which hidden content directs a coding agent to create an audit-hook wrapper and execute arbitrary remote code through it. The technique bypasses content-safety filters because the malicious instruction is embedded in a channel those filters do not inspect. Enterprises relying on text-prompt red-teaming alone are structurally exposed.