OpenAI Codex Chronicle Watches Your Screen to Build AI Context

OpenAI has launched Chronicle, a new opt‑in research preview for its Codex Mac app that gives the AI assistant ambient awareness of what you're working on. The feature runs background agents that periodically capture screenshots of your desktop, then sends those captures to OpenAI's servers for processing. The result is a set of text‑based "memories" stored locally on your machine that Codex can reference when you ask it to help with tasks.

According to OpenAI's developer documentation, Chronicle can resolve ambiguous references like "this" or "that" by identifying the specific error on your screen, the document you have open, or the project you were working on days ago. Greg Brockman, OpenAI President, called it "surprisingly magical to use" — an experimental feature that gives Codex the ability to see and remember what you see.

The feature requires both Screen Recording and Accessibility permissions on macOS and is currently limited to ChatGPT Pro subscribers on Apple Silicon Macs. Raw screenshots are stored temporarily and deleted after six hours, while the generated text summaries persist as local Markdown files at ~/.codex/memories_extensions/chronicle/.

While Chronicle promises to eliminate the "context reset" problem that plagues AI coding assistants, its architecture raises significant privacy concerns. Unlike Microsoft Recall, which processes everything locally using NPUs and stores data in encrypted databases with biometric locks, Chronicle sends screenshots to OpenAI's servers for OCR and visual analysis. The resulting memories are stored as unencrypted plain text Markdown files accessible to any process on your Mac.

OpenAI explicitly warns that Chronicle increases the risk of prompt injection attacks — malicious instructions on a website you scroll past could be read by Chronicle and followed by Codex as legitimate commands. The company also notes that the feature consumes API rate limits quickly due to background agent activity, even when you're not actively prompting.

Perhaps the most telling detail: Chronicle is unavailable in the EU, UK, and Switzerland, suggesting OpenAI anticipates conflicts with GDPR's data minimization and purpose limitation requirements. As The Decoder reports, users are advised to manually pause Chronicle via the menu bar icon during meetings or when viewing sensitive data — a process that relies entirely on user discipline rather than technical safeguards.

Chronicle is part of a broader shift toward "ambient intelligence" — AI assistants that understand context without manual input. 9to5Mac notes that OpenAI is positioning Codex as a "superapp" for builders, expanding beyond agentic coding into broader professional workflows. The Chronicle feature bridges the gap between the AI and your active workspace.

The ambient AI space is getting crowded. Microsoft Recall processes screenshots locally on Copilot+ PCs with hardware‑secured encryption. Screenpipe offers an open‑source, local‑first alternative. Meanwhile, Rewind AI — one of the early pioneers in screen capture for AI context — was acquired by Meta in late 2025 and its Mac screen capture feature was disabled. Gartner predicts that over 40% of large enterprises will deploy ambient intelligence pilots by 2026.

What makes Chronicle different is its tight integration with a coding agent. While Recall and Screenpipe are general‑purpose memory tools, Chronicle feeds context directly into Codex's agentic workflow, letting it take actions based on what it sees on your screen — not just remember it for later retrieval.

Chronicle represents a genuine shift in how AI coding tools work: from passive assistants that need hand‑holding to ambient agents that understand your environment. For builders doing multi‑week projects on macOS, the ability to say "fix that error" without re‑explaining context could save significant time. The fact that memories are stored as local Markdown files means you can audit, edit, or delete them — a level of transparency that cloud‑only solutions don't offer.

But the trade‑offs are real. The prompt injection risk means that any website, Slack message, or email visible on your screen becomes a potential attack vector. The unencrypted local storage means any compromised tool or process on your machine can read your captured work context. And the rate limit consumption means Chronicle could eat into your Codex agent quota before you even start coding.

For builders handling regulated data — healthcare, legal, finance — Chronicle is a non‑starter in its current form. For open‑source developers working on public repos, the risk calculus looks different. The key question isn't whether ambient AI context is useful (it clearly is), but whether OpenAI's cloud‑first, unencrypted approach is the right architecture to deliver it. The EU's exclusion suggests even OpenAI isn't sure.