Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does OpenAI Dots Keep Screenshots of What It Did?
Not from the pages reviewed: OpenAI says Reset deletes a dot's conversations, saved memories and scheduled tasks, but no dot page states whether images of the pages it reads are stored, or for how long. Treat the session as the container and get the retention term in writing before a dot opens a patient account screen.
A privacy officer at a clinic has a new question about the agent that runs errands for the staff inside ChatGPT. A dot can open a patient account screen, read the name, date of birth, member number, policy number and balance, and prepare the note or the payment the team asked for. Dots launched on September 29, 2026 as always-on AI agents with their own cloud computers (The Next Web, 2026), and each dot keeps working after the person who started it has moved on to another task. What happens to the picture of the page afterwards is the part the documentation leaves open. A screenshot is one way a session can hold a page, the page text is another, and the help article does not say which one a session keeps. OpenAI's help pages explain the rules a dot follows and the one action that clears its history, and they do not describe a separate image store, a per-run capture log or a retention period for what a dot saw. The nearest published statement about screenshots comes from a product OpenAI has retired. A team deciding whether a dot may touch patient accounts has to treat that silence as a term of its own, and decide what it will accept before the first run.
Key findings
- For a dot's session to be safe to keep, the values on a patient account screen would have to be replaced with consistent tokens before the model reads the screen, so the conversation holds PATIENT_001 and ACCT_002 instead of a name and an account number (What Is Render-Layer Tokenization?).
- It would also require a named person approving each record change or payment a dot proposes, and a record of what the model received on every screen, with the human approval that OpenAI's governance paper calls "a standard way to limit egregious failures" (Shavit et al., 2023).
- The gap is retention: the help article reviewed names one removal path, Reset, and does not state whether an image of a page survives in the conversation, or for how long (OpenAI, Getting started, 2026).
- OpenAI's dot help article says "Reset deletes your dot, including its conversations, saved memories, and scheduled tasks," which makes the conversation the container a retention review has to cover (OpenAI, Getting started, 2026).
- The retired ChatGPT Agent's help page records that screenshots were not captured during a takeover, which "helps protect passwords," a narrow exclusion that says nothing about a page the agent read on its own (OpenAI, ChatGPT agent, 2026).
- Screenshot-driven GUI agents "may inadvertently expose sensitive information such as identities, accounts, locations, and behavioral traces," which is what a stored image of a patient account screen would hold (Wang et al., 2026).
What does a dot record when it works a patient account screen?
Take one record type: a patient account screen with the patient's name, date of birth, member number, policy number and open balance. The dot help article describes a dot as "an always-on agent in ChatGPT that can help you take a project from an idea to work you can use" (OpenAI, Getting started, 2026). Dots run in their own cloud computer and browser, so the page is the page the billing team sees (Do OpenAI Dots Rules Control What the Agent Sees?).
The live page on claim files reads OpenAI's safety write-up as describing webpage text and document content within connected apps, with only credentials kept out (Can Insurers Use OpenAI Dots on Claim Files?). A name, a member number and a balance are not credentials. The live page on patient records adds that no key holder or certification is named (Can OpenAI Dots Be Enabled on Patient Records?).
| Field | Why the team keeps it there | What a stored session would hold |
|---|---|---|
| Patient name and date of birth | The account cannot be matched without them | Both values as the page draws them |
| Member and policy number | The payer check turns on them | The identifiers in full |
| Open balance | The team quotes it to the patient | The amount and the date |
The record that survives is the conversation. OpenAI's dot help article says "Reset deletes your dot, including its conversations, saved memories, and scheduled tasks" (OpenAI, Getting started, 2026). Whether an image of the screen sits inside that container is not stated.
Rishov Chatterjee, AI engineer at Curology and former Director of Data Science and AI at Integra Connect, described on a HAL podcast how an image of a patient identifies the person: "when you have images of a patient, let's say you have a selfie and you're trying to look at their, let's say their acne or things like that, you can still determine who the person is" (HAL Transcript: Rishov Chatterjee).
The gap is the one What Is the PII Wall? names: the workflow depends on a record the security team will not let a model see.
What do OpenAI's pages say about screenshots and deletion?
The dot help article answers deletion, not retention. "Reset deletes your dot, including its conversations, saved memories, and scheduled tasks" (OpenAI, Getting started, 2026). That is one action for the whole dot, and the article describes no smaller operation that removes one page image while keeping the conversation. It does not state whether an image survives, or for how long.
The data controls page governs training, not storage. "Data controls let you choose whether your conversations help train OpenAI models," and "Turning off Improve the model for everyone does not delete or hide saved chats" (OpenAI, Data controls, 2026). A healthcare workspace can have training off and still hold the conversation.
The nearest screenshot statement is narrower. The retired ChatGPT Agent's page records that screenshots were not captured during a takeover, which "helps protect passwords" (OpenAI, ChatGPT agent, 2026). The live page on cardholder data reads OpenAI's secure sign-in as sending credentials to the browser environment "without exposing them to the model's context," a control on the login step rather than on the page that follows (Can OpenAI Dots Handle Cardholder or Bank Data?).
The workspace log is bounded too: the ChatGPT Work admin FAQ says its Compliance Logs Platform "retains data for 30 days" and its records "don't establish a complete audit trail" (OpenAI, Work admin, 2026). Read together, the pages support one working assumption: an image is kept with the conversation, for as long as the conversation is kept, and Reset is the only documented way to end that. What is not described in the pages reviewed is a separate image store or a stated retention period for the images.
What do the vendors themselves say?
OpenAI is the only vendor whose documentation covers this product, and its pages describe the rules, the deletion path, the training default and the workspace log. None states a retention period for the images a dot's session may hold.
The dot help article describes a dot as "an always-on agent in ChatGPT that can help you take a project from an idea to work you can use," and it sorts custom rules into four behaviors, from "Take action without asking" to "Hand off to you." It warns that "Your dot can make mistakes, including when following your rules," and on deletion it says "Reset deletes your dot, including its conversations, saved memories, and scheduled tasks" (OpenAI, Getting started, 2026).
The data controls page covers a different question. It says "Data controls let you choose whether your conversations help train OpenAI models," and a managed-workspace default keeps content out of training, which leaves the stored conversation in place (OpenAI, Data controls, 2026).
The later pages bound the record. The ChatGPT Agent page states that with connected apps the agent "can access sensitive data like emails, files, or account settings," and that screenshots were not captured during a takeover, which "helps protect passwords" (OpenAI, ChatGPT agent, 2026). The ChatGPT Work admin FAQ says its Compliance Logs Platform "retains data for 30 days" and is not a complete audit trail (OpenAI, Work admin, 2026).
Who approves what a dot does, and what record does the approval leave?
The dot help article's four behaviors answer a question about action. A workspace can let a dot "Take action without asking," let it act when pre-approved, make it ask first, or hand the work back (OpenAI, Getting started, 2026). Each choice names who, if anyone, is asked before a step, and none names who approved a step after the fact. The article warns that "Your dot can make mistakes, including when following your rules," so the approval is only as reliable as the record beside it.
A review of 15 AI agents counted OpenAI Dots among 5 whose published pages describe a per-action record an administrator can export, and found only 1 that documents asking a person by default before every consequential action (Do AI Agents Ask Before Making a Payment?).
OpenAI's governance paper sets the standard. Human approval "is a standard way to limit egregious failures," and "at least one human entity is accountable for every uncompensated direct harm" (Shavit et al., 2023). It also says actions that can only be reviewed after the fact "should be more easily reversible," which presumes a record detailed enough to reverse.
The approval dialog is not the record. OWASP's page on HITL dialog forging describes an attack that "manipulates the content and presentation of approval dialogs, deceiving users into authorizing malicious operations" (OWASP Foundation, 2026). Automation bias adds a second reason: "the tendency to over-rely on automation" has been studied in various academic fields, and a person watching a dot work a patient account sees the action it proposes rather than the fields it read (Goddard et al., 2012).
The workspace log is a floor. The ChatGPT Work admin FAQ says its Compliance Logs Platform keeps data for 30 days and is not a complete audit trail for every browser interaction, tool call or approval. A reviewer needs the screen, the action and the named approver.
What does a governed environment change?
A governed environment acts where the screen is rendered, before any model reads it. Values chosen by policy are replaced with consistent tokens for the whole run, so a dot working a patient account screen sees PATIENT_001, MEMBER_002 and ACCT_003 where the name, member number and balance sit. Real values resolve only at an approved destination, at the moment of an approved action, so the record change reaches the real account only when a named person approves it.
That changes the retention question. If the session holds tokens, a conversation kept for a month or a year contains placeholders. The record of the run is the tokenized screen, the action taken on it and the approval, exported to the practice's own monitoring, and the real values live in the store the environment controls rather than in the chat. Deleting the session still matters, and it no longer decides whether the patient's data can be reconstructed from what the model read.
The design applies to the record type rather than to one vendor's product. RedactSure vs OpenAI Dots sets out where a rules layer ends and a render-layer control begins, and What Is Render-Layer Tokenization? describes the substitution itself. For this page's question, the control changes what a stored session contains.
What the record shows
The record a dot leaves is the conversation, and the only removal path the help article names is Reset, which deletes the dot with its conversations, saved memories and scheduled tasks (OpenAI, Getting started, 2026). Whether an image of the patient account screen sits inside that conversation is not stated, and the pages reviewed describe no separate image store. For a privacy officer, the test is one workflow: name one patient account screen, run one read-only task, then compare the conversation's text and attachments with the fields the screen drew, and write the vendor's retention term beside that comparison.
Methodology and limitations
This page rests on OpenAI's dot help article, its data controls page, its ChatGPT Agent page and its ChatGPT Work admin FAQ, together with an OpenAI governance whitepaper, a privacy benchmark for screenshot-driven agents, OWASP's attack page on approval dialogs and a systematic review of automation bias. Public documentation read in full gives a sound view of where each product applies its control. Vendor pages were read as of October 22, 2026, and each Sources line carries the date for its page.
No product on this page was tested for this page, and the products are described from documentation. RedactSure is deploying now with enterprise and government customers. "Not described" means the pages reviewed, vendor features change and the page carries its date, and the patient account screen describes a record type rather than an organization. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Does OpenAI Dots keep screenshots of what it did?
Not from the pages reviewed. The dot help article says Reset deletes the dot with its conversations, saved memories and scheduled tasks, and it describes no separate image store, no per-run capture log and no retention period for page images. The ChatGPT Agent page is the nearest screenshot statement, and it covers only a takeover, when screenshots were not captured. Treat the session as holding what the dot read until OpenAI states a term in writing.
What does a dot keep after it reads a patient account screen?
The conversation. A dot reads the page as rendered, and the help article describes the conversation as the thing Reset removes, which makes it the container a retention review has to cover. Whether the page is stored as text, as an image or as both is not stated. Assume every field the screen drew is in that container, including the name, member number and balance.
Does Reset delete the record of what the dot read?
Only through the dot's own record. The help article says "Reset deletes your dot, including its conversations, saved memories, and scheduled tasks," one action for the whole dot. It describes no smaller operation that removes one page image while keeping the conversation. A copy in an export, a support ticket or a workspace log is outside that action, and the pages reviewed do not say whether Reset reaches it.
Do OpenAI's data controls change what a dot's session holds?
No. The data controls page governs training, not storage. It says "Data controls let you choose whether your conversations help train OpenAI models," and it says that turning off Improve the model for everyone "does not delete or hide saved chats." A healthcare workspace can have training off and still hold a conversation that contains a patient account screen. Ask about retention separately from training.
Who approves what a dot does with a patient record?
The person named in the workspace's rules, if the workspace names anyone. The help article's four behaviors include one that lets a dot "Take action without asking," so an approval is a setting the workspace chooses rather than a step the product requires. OpenAI's governance paper calls human approval "a standard way to limit egregious failures" and asks that "at least one human entity is accountable for every uncompensated direct harm."
What should a security team ask for in writing about the record?
A field list per page type, the term for page images and page text, what Reset reaches, who can open the conversation, and where the approval record lives. The first question is what the model receives from a rendered screen, field by field, and which values are replaced or withheld before it reads the page. Ask for each answer beside the date of a test run on one patient account screen.
How RedactSure Keeps a Patient Account Screen Out of the Record
A dot that reads a patient account screen keeps the name, member number and balance for the rest of the run, and Reset is the only removal path. OpenAI's dot help article says "Reset deletes your dot, including its conversations, saved memories, and scheduled tasks" (OpenAI, Getting started, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the screen renders the patient's name, member number, policy number and balance, and all of it enters the model's context. Inside, it renders PATIENT_001, MEMBER_002 and ACCT_003, the dot works on those tokens, and real values resolve only at the approved destination on a named person's approval.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A retention term you can quote is what an auditor will ask for after a dot reads a patient account. Bring one account screen and see, with test values, what the model reads, who approves the change and what the record holds. Book a demo