OpenAI's macOS Computer History Feature Logs Keystrokes in Unencrypted Plaintext

·8 views

OpenAI has introduced a 'Computer History' feature for its ChatGPT macOS app that tracks user clicks, keystrokes, and application switches to build a searchable activity timeline. The feature uses macOS accessibility tools to give ChatGPT persistent context about a user's work, enabling the agent to act more informatively on their behalf. However, the activity logs are stored locally as unencrypted plaintext Markdown files, meaning any process running under the same user account could potentially read them. While the feature is opt-in, supports app blacklisting, and skips private browsing activity, security researchers warn the unencrypted format poses real risks given the sensitive data — such as API keys, credentials, and private messages — that may pass through a user's screen. Experts also flag an expanded prompt injection risk, as malicious content in tracked apps like Slack could theoretically influence future AI-assisted actions.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why AWS S3 Egress Fees Can Turn a $2 Storage Bill Into $180+

Cloud storage on platforms like AWS S3 appears inexpensive at roughly $0.023 per GB per month, but a separate charge called egress — applied every time data leaves the provider's network — can dwarf storage costs. At approximately $0.09 per GB, egress fees accumulate rapidly because they are triggered by every user download, CDN cache miss, cross-region replication, backup export, and even failed transfer retry. A single popular file served to millions of users can generate terabytes of billable outbound traffic from one asset alone. Unlike storage costs, egress is not capped by how much data you hold but by how much you serve, making it difficult to predict from a pricing page. Developers and businesses are advised to model both storage and egress costs separately before choosing a provider, as the latter is often the dominant line item in real-world bills.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LighthouseReckoning Brings Lightweight LoRa Mesh Networking to Arduino, ESP32 and RP2040

A developer has released LighthouseReckoning, an open-source LoRa mesh networking library designed for Arduino-compatible microcontrollers, currently tested on ESP32 and RP2040 with SX126x radios. The library enables multi-hop sensor data routing toward a single Home node without requiring manual route configuration or full network topology awareness. It uses a distance-vector approach where each node tracks neighbors and their hop count to Home, selecting the best next-hop dynamically. Reliability is handled through hop-by-hop confirmations and local retries, rather than a single end-to-end acknowledgment, reducing the coordination burden on the Home node. The full source code, protocol documentation, and field-test data are publicly available on GitHub, with future plans covering security improvements and broader hardware support.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds AI Tool to Auto-Document Undocumented APIs from Source Code

A developer released an open-source tool called API Archaeologist after spending days manually tracing undocumented and outdated API routes on a new team. The tool is a skill file for Claude Code and Codex CLI that scans backend source code directly, without relying on existing annotations or OpenAPI specs. It automatically generates a full API catalog in Markdown with Mermaid diagrams and a draft OpenAPI YAML file. The tool is designed for legacy codebases and projects where documentation has fallen behind the actual code. It is available on GitHub and works by running a single command from within a backend repository.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five-Step Guide to Transactional Email Warmup for Safe Deliverability Scaling

A structured approach to transactional email warmup recommends using a dedicated sending domain and letting real business demand drive volume increases rather than following arbitrary calendar schedules. Engineers are advised to authenticate all sender identities, envelope paths, and tracking behavior before the first production send, prioritizing payment receipts over lower-urgency mail. Volume should be scaled in cohorts, with each batch fully observed and its bounce, complaint, and deferral signals reconciled before the next increase begins. To manage storage costs, teams should retain compact audit records — template versions, render inputs, and delivery events — while expiring full rendered message bodies on a defined schedule set by compliance requirements. The fallback sending lane should only be retired after peak traffic, retries, and at least one template change have successfully passed through the new domain without gaps in the delivery ledger.

0 comments Read more at DEV Community