OpenAI’s Codex for Mac now watches your screen to build context, but sends the screenshots to its servers first

Summary: OpenAI’s Codex for Mac has added Chronicle, a research preview feature that periodically captures screenshots, sends them to OpenAI’s servers for processing, and stores text summaries as local unencrypted Markdown files to give the AI assistant passive context about user activity. The feature is unavailable in the EU, UK, and Switzerland, requires a $100+/month Pro subscription and Apple Silicon, and represents OpenAI’s first implementation of ambient screen-aware AI on desktop, choosing cloud processing and utility over the local-first privacy architecture adopted by competitors like Screenpipe and the now-defunct Rewind AI.

OpenAI’s Codex desktop app for Mac has gained a feature called Chronicle that periodically captures your screen, processes the content into text summaries, and stores those summaries as local memory files that give the AI assistant context about what you have been working on. The feature, released as a research preview, means Codex can now understand your recent activity without you having to explain it. It also means OpenAI is sending screenshots of your desktop to its servers for processing, a design choice that puts Chronicle in direct tension with the privacy-first direction that much of the industry has been moving toward.

Chronicle is part of a broader update that transformed Codex from a coding assistant into a general-purpose AI workspace. The 16 April release, titled “Codex for (almost) everything,” added computer use capabilities that allow Codex to operate Mac apps with its own cursor, an in-app browser, image generation, persistent memory, and more than 90 plugins. Over one million developers have used Codex, and usage doubled following the launch of the GPT-5.2-Codex model in December.

How Chronicle works

Chronicle runs background agents that periodically capture screenshots of your display. Those screenshots are sent to OpenAI’s servers, where they are processed using OCR and visual analysis to generate text summaries. The summaries are saved as Markdown files in a local directory at ~/.codex/memories_extensions/chronicle/. When you subsequently prompt Codex, those memory files are included in its context window, allowing it to understand what applications you were using, what documents you were reading, what code you were writing, and what conversations you were having, all without you restating any of it.

The raw screen captures are stored temporarily under a system temp directory and automatically deleted after six hours. OpenAI states that screenshots are not stored on its servers after processing and are not used for training. The generated memories, however, persist indefinitely as unencrypted plain text files on your machine.

Greg Brockman, OpenAI’s president, described the feature as “an experimental feature giving Codex the ability to see and have recent memory over what you see, automatically giving it full context on what you’re doing. Feels surprisingly magical to use.”

The privacy architecture

Chronicle requires macOS Screen Recording and Accessibility permissions. It is available only on Apple Silicon Macs running macOS 14 or later, and only to ChatGPT Pro subscribers paying $100 or more per month. It is not available in the EU, UK, or Switzerland, a geographic restriction that strongly suggests OpenAI recognises the feature’s incompatibility with GDPR’s requirements around data minimisation and purpose limitation.

The comparison with Microsoft Recall is instructive. Recall, which launched on Windows Copilot+ PCs, takes screenshots every few seconds and stores them in an encrypted local database, with all processing handled by a neural processing unit on the device. No screenshot data leaves the machine. Chronicle takes the opposite approach: processing happens in the cloud, but only text summaries are retained locally. Recall encrypts its database and requires biometric authentication via Windows Hello. Chronicle stores its memories as unencrypted Markdown files accessible to any process running on the computer.

OpenAI’s own documentation acknowledges the risks explicitly. Chronicle “increases risk of prompt injection” because malicious content on a website you visit could be captured in a screenshot and interpreted as instructions by the AI. The memories directory “might contain sensitive information.” And the feature “uses rate limits quickly,” meaning Pro subscribers may find their Codex usage constrained by Chronicle’s background activity.

OpenAI recommends pausing Chronicle before meetings or when viewing sensitive content. Users can pause and resume via the Codex menu bar icon. The recommendation is itself revealing: it acknowledges that the feature will capture things it should not, and shifts the burden of managing that risk to the user.

The category and its casualties

Screen-aware AI assistants have had a turbulent history. Rewind AI, the most prominent early entrant, rebranded to Limitless before being acquired by Meta in December 2025. The Mac app was shut down and screen capture disabled. Microsoft’s Copilot has lost 39% of its subscribers in six months, partly due to trust issues that extend to Recall. A security researcher demonstrated in early 2026 that Recall’s encrypted database could still be exploited, reinforcing concerns that had dogged the feature since its announcement.

The open-source alternative Screenpipe offers a local-first approach: continuous screen and audio capture processed entirely on-device, with a $400 lifetime licence and no recurring cloud dependency. Perplexity’s Personal Computer software takes yet another approach, turning a Mac mini into a persistent AI agent with access to local files and apps, though it too relies on cloud processing for its core intelligence.

The pattern across the category is consistent: the more useful a screen-aware AI becomes, the more data it needs to process, and the harder it becomes to reconcile that data appetite with user privacy. Chronicle opts for utility over privacy architecture, betting that OpenAI’s promise not to store or train on the data, combined with the six-hour deletion window, is sufficient to earn user trust. Whether that bet pays off depends entirely on whether users believe the promise and whether OpenAI can maintain it as the feature scales.

The ambient computing context

Chronicle arrives as the industry converges on the idea that AI assistants should understand your context without being told. Apple is testing AI smart glasses designed as ambient input channels for Apple Intelligence. Slack’s recent AI overhaul turned Slackbot into a desktop agent with deep context about your work communications. OpenAI itself is developing a screenless hardware device with Jony Ive that is explicitly positioned for an “ambient AI” era. Gartner predicts more than 40% of large enterprises will deploy ambient intelligence pilots by 2026.

The thesis is that AI becomes dramatically more useful when it has passive, continuous access to what you are doing rather than requiring you to articulate your needs from scratch each time. Chronicle is OpenAI’s first implementation of that thesis on desktop, and it works: by Brockman’s account and the feature’s design, eliminating the need to re-explain context to an AI assistant is a genuine productivity gain.

But the thesis has a cost. Privacy-first alternatives like Proton’s AI tools demonstrate that useful AI can run on open-source models locally without sending user data to anyone’s servers. The question Chronicle poses is not whether screen-aware AI is useful. It plainly is. The question is whether the cloud-processed, trust-dependent model that OpenAI has chosen will survive contact with the regulatory environment that has already excluded it from three jurisdictions, and with users who have watched enough AI companies promise data privacy only to quietly revise their terms when the economics demanded it.