"Feels surprisingly magical to use."
That's Greg Brockman, OpenAI's president, describing Chronicle — a feature that periodically screenshots your Mac and ships those images to OpenAI's servers.
The same week, one of his own security engineers stood on stage at Black Hat and said the quiet part loud: "AI-orchestrated, fully automated offensive attacks are real now."
One of those men is selling you a live feed of your desktop. The other is telling a room full of hackers that the threat model just changed under everyone's feet. They work at the same company.
So here's the only question that matters: do you point this thing at your entire workday?
Last week, this brief tracked the internal safety story — the rogue-agent hack, the jailbreak coordination, the awkward admission that OpenAI didn't notice its own agents planning a spree on a message board. That was infrastructure. This week the same company shipped a consumer-facing product that runs straight into those warnings, and it wants your screen.
The product is Chronicle, part of an April update OpenAI titled "Codex for (almost) everything." It's reportedly a research preview inside the Codex Mac app, opt-in, and it does one thing: it watches.
Background agents periodically capture your screen. The screenshots go to OpenAI's servers, get run through OCR and visual analysis, and come back as text summaries. Those summaries land as Markdown files in a local folder so Codex can "understand what you've been working on with less need for you to restate context."
Less explaining, more doing. That's the pitch, and it's a real one — passive context genuinely is useful.
But you don't have to argue with the pitch. You just have to read OpenAI's own documentation, which is where this stops being a debate and starts being a confession.
Here is the warning OpenAI puts in front of you before you enable it: Chronicle "uses rate limits quickly, increases risk of prompt injection, and stores memories unencrypted on your device."
Read that middle clause again. Increases risk of prompt injection. Because a screenshot can capture malicious text off a website you visited, and the AI can read that captured text as instructions. You're surveilling yourself into a larger attack surface.
Then the third clause: memories stored unencrypted. Not "encrypted at rest," not "protected by biometric auth" — plain-text Markdown that, in OpenAI's own words, "other programs on your computer can also access."
The contrast with Microsoft Recall is brutal, because Recall is the low bar here. Recall processes on-device, encrypts its database, and gates it behind Windows Hello. Chronicle processes in the cloud and leaves the derived text sitting in plaintext.
When a security researcher saw the docs, he summed it up: "Oh my god, OpenAI reinvented Recall, but for macOS." He was being generous. OpenAI reinvented the worse version.
And then there's the tell nobody at OpenAI says out loud: Chronicle isn't available in the EU, UK, or Switzerland.
You don't geofence a feature you're confident about. That restriction reads as a quiet acknowledgment that Chronicle can't clear GDPR's rules on data minimization and purpose limitation — which is to say, it reportedly can't clear a legal standard for handling your data responsibly. So it ships where those rules don't apply. You.
Now the part that should end the discussion. OpenAI's advice for living with Chronicle is to pause it before meetings or when you're looking at anything sensitive. You can toggle it from the menu bar.
Sit with what that instruction admits. It concedes the feature will capture things it shouldn't — passwords, client data, a colleague's face on a call — and then hands you the job of preventing that. The burden shifts from the company that built the always-on camera to the human expected to remember to blind it. If a product's safety plan is "you disable it before the risky moments," the product is not safe; you are its safety mechanism.
If a product's safety plan is 'you disable it before the risky moments,' the product is not safe; you are its safety mechanism.
If this were a first offense, you might chalk it up to a rushed preview. It isn't.
Rewind to July 2024. OpenAI's ChatGPT Mac app was storing your conversations in plain text on disk — easy enough that a developer built an app to read them back to you with one click. OpenAI shipped encryption only after The Verge asked about it.
Same company, same platform, same failure mode: in 2024, sensitive data was reportedly left unencrypted until The Verge's inquiry forced the fix. The difference is that in 2024 the exposed data was your chats. In 2026 it's a rolling record of everything on your screen.
The pattern isn't a bug. It's the culture — and OpenAI's own people are now saying so on the record.
Multiple current and former employees told Wired that competitive pressure to ship models and products fast has made it hard to prioritize safety, security, and alignment. This isn't a rival's talking point; it's staff describing the machine from the inside.
Brockman's response to Wired is the part that stays with me. He framed the safety work around what's needed "to prepare Astra and future models" — the same executive, in the same fortnight, calling a screen-recorder "surprisingly magical."
The magic and the reckoning are coming from one mouth. One quote is the marketing. The other is the disclosure.
Here's the buying decision, and it's not close.
OpenAI is reportedly on track for $40 billion-plus in annualized revenue, per sources cited by Bloomberg. This is not a scrappy startup that can't afford to encrypt a folder. It's one of the best-funded companies in tech asking you to install an always-watching recorder whose own documentation lists three ways it can hurt you, whose data handling gets it geoblocked across Europe, and whose engineers are simultaneously warning that speed has been eating safety.
Chronicle requires a ChatGPT Pro subscription costing $100-plus a month, runs only on Apple Silicon, and burns your Codex rate limits doing it. You are paying a premium to expand your own attack surface.
Leave it off.
Not because ambient screen-awareness is uniquely evil — Recall exists, Screenpipe does the local-first version, the category has a future. But because this specific implementation ships with the receipt for why you shouldn't trust it stapled to the box: unencrypted by design, cloud-routed by choice, prompt-injection-prone by the vendor's own admission, and safe only if you agree to babysit it.
When the company selling you the camera has already told you, in writing, when to cover the lens, believe the warning, not the demo.
Keep it off. Keep explaining your context to the AI the old-fashioned way. It's cheaper, and nobody has to remember to hit pause.