Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Happened to the Screenshots ChatGPT Agent Kept in Your Chat History?
They stayed in the conversation history until the chat was deleted, and deleted chats were purged within 90 days, according to the help page for the retired agent. Anyone who ran ChatGPT Agent on a bank or payroll page should find those sessions, delete them and write down the date.
Anyone who asked ChatGPT Agent a year ago to read a balance on a bank's account page, check a recent deposit and update a note may still hold a picture of that page. The agent clicked through as a person would, the chat saved what it saw, and the image is still attached to the conversation.
The product that took it has been retired, and its help page is still online. That page says what the old product did with the images: they were kept in conversation history until the conversation was deleted, and deleted conversations were purged within 90 days (OpenAI, Atlas agent, 2026). That leaves a task, because a chat that was never deleted still holds them, and the person who ran it may not remember which chats those were.
The stakes are specific. A screenshot of an account page carries an account number, a balance, sometimes a name and an address, and it lives as long as the chat does. Anyone who can open the conversation can open the image, and a retention schedule written for documents may never have covered a chat log. Finding those sessions and knowing what deletion removes is the work.
Key findings
- For a stored screenshot of a bank page to be harmless, the values on it would have to be replaced with consistent tokens before any model reads the screen, so the chat holds ACCT_001 instead of an account number (What Is Render-Layer Tokenization?).
- It would also require a named person approving each payment or record change and a record of what the model received on every screen (What Is the PII Wall?).
- The help pages reviewed do not describe a control that removes one screenshot while keeping the conversation; deleting the chat is the only path they name (OpenAI, Atlas agent, 2026).
- OpenAI's ChatGPT Agent help page states that with connected apps the agent "can access sensitive data like emails, files, or account settings," and that screenshots were not captured during a takeover, which "helps protect passwords" (OpenAI, ChatGPT agent, 2026).
- The agent behind the page is retired: the help page notes the move to ChatGPT Work, and OpenAI retired the Atlas browser in August 2026 (OpenAI, ChatGPT agent, 2026; OpenAI, Atlas retirement, 2026).
- A measured evaluation found web agents "are prone to inadvertent use of unnecessary sensitive information," and a study found GPT-4 and ChatGPT "reveal private information in contexts that humans would not" in 39% and 57% of cases (Zharmagambetov et al., 2025; Mireshghallah et al., 2024).
What did the agent capture on the screen, and where did it go?
The product behind the question is ChatGPT Agent, which OpenAI has retired in favor of ChatGPT Work, and its help page is still online (OpenAI, ChatGPT agent, 2026). That page describes what the agent could reach, including that with connected apps it "can access sensitive data like emails, files, or account settings," and the Atlas page recorded that it "cannot access other apps on your computer or file system" (OpenAI, Atlas agent, 2026).
For a bank's account page, reach is the story. The page renders the account number, the balance, the holder's name and a table of recent transactions, and the agent reads that rendered page to do its task. The screenshot is the view a person at the screen would have taken. The Atlas page said the agent "will pause to ensure you're watching it take actions on specific sensitive sites such as financial institutions," which narrowed when someone was watching, not what the page displayed (OpenAI, Atlas agent, 2026).
The image kept the value because the review describes no step that replaces it on screen: 0 of 15 AI agents reviewed for payment controls describe protecting the customer data on a working page with tokens the agent can work with (Do AI Agents Ask Before Making a Payment?). The retired ChatGPT Agent was not one of the 15.
Where the image went is the part the page answers directly: the screenshots were kept in conversation history until the conversation was deleted (OpenAI, Atlas agent, 2026). That sentence describes no separate screenshot store or per-run log, so the chat is the container, as Is It Safe to Let ChatGPT Work Access Sensitive Company Data? sets out for the product that replaced it.
What happens to those screenshots when you delete the chat?
The deletion path is documented, and it takes two steps. The help page states that a deleted chat leaves the history and that the back-end copy is purged within 90 days, the only removal window the pages give for a screenshot (OpenAI, Atlas agent, 2026). The image has no delete control of its own and no place in an export list that the pages reviewed describe.
Two limits matter for a cleanup. The term belongs to a product OpenAI no longer sells: the ChatGPT Agent help page notes the retirement in favor of ChatGPT Work, and the Atlas browser was folded into that new product in July 2026 (OpenAI, ChatGPT agent, 2026; PPC Land, 2026). A team that reads 90 days as a current commitment is reading a page that describes a retired one. The pages also say nothing about copies outside the conversation, such as an exported chat file, a saved link or a screenshot pasted into a ticket, and a deletion inside the product cannot reach those.
That leaves a practical reading. If the chat is deleted, the image leaves the account and the back-end copy follows within 90 days. If the chat is still there, the image is still there. Two dates belong in the record: the day the chat was deleted and the day 90 days later when the copy should be gone. That pair is what an auditor will ask for, and it is the only evidence the team will have that the window ran.
What do the vendors themselves say?
OpenAI is the only vendor whose documentation covers this product, and its pages describe reach, one retention term and a limit on what the agent could touch.
The Atlas agent mode page stated that in logged-in mode the agent could use "sites you're already signed in to," and that screenshots were kept in conversation history until deletion (OpenAI, Atlas agent, 2026). The ChatGPT Agent page states that with connected apps the agent "can access sensitive data like emails, files, or account settings" and that screenshots were not captured during a takeover, which "helps protect passwords" (OpenAI, ChatGPT agent, 2026).
| Dimension | OpenAI, per its documentation | What a buyer should verify |
|---|---|---|
| What the agent could reach | Logged-in mode uses "sites you're already signed in to"; connected apps reach "emails, files, or account settings" | Which applications held a session, and whether the session outlived the task |
| What was kept | Screenshots "kept in conversation history"; no separate image store described | Whether the account, a workspace system or a support queue holds a second copy |
| Retention | Kept until the chat was deleted, with a 90-day back-end purge | The written term, when the clock starts and what pauses it |
A reader who needs one screenshot gone has no documented path.
Who can read a screenshot that sits in a shared chat?
Access follows the conversation. Anyone who can open the chat can open the image: the person whose account ran the task, anyone the conversation was shared with, and the administrators a workspace plan documents.
The content is what makes that audience matter. OWASP's entry on sensitive information disclosure states that "Personal identifiable information (PII) may be disclosed during interactions with the LLM," and a screenshot of an account page is that disclosure in an image (OWASP, 2025). A measured study of GPT-4 and ChatGPT found the models "reveal private information in contexts that humans would not" in 39% and 57% of cases; a stored image needs no reveal, because the page already showed it (Mireshghallah et al., 2024).
The same image can carry text the page never held. OpenAI's research on Atlas called prompt injection "unlikely to ever be fully 'solved'," so a page may have held instructions placed by someone else, and the picture keeps them (OpenAI, Hardening, 2025). Columbia's DAPLab puts the split this way: access control governs who can touch data, but "neither governs how data flows and is used during agentic execution" (Columbia DAPLab, 2026). The conditions that make such a page dangerous are set out in Is It Safe to Let AI Agents Read External Web Pages?.
How do you clean up a year of agent history?
Cleanup starts with the conversations, because the documentation ties the image to the chat. Search the history for the applications that carried the sensitive page: the bank's domain, the payroll provider, the card issuer. Chat titles and the first line of each task are what the history shows, so search by vendor name and by task.
Delete the matches. Archiving leaves the chat in place, and the page ties the purge to deletion. Write down each deletion date, because the 90-day window starts there and an auditor will ask when the image left.
Then check the copies a deletion does not reach: a saved link, an exported chat file, a screenshot pasted into a ticket. Those sit outside the conversation, and the pages give no term for them. Treat an export as a record of the account page and schedule it with other records of customer data. How a saved image becomes a pasted value is the subject of Can a Browser Agent Be Tricked Into Pasting Sensitive Data Into a Chat?.
Finally, deal with what the image exposed. An account number cannot be rotated, but a password typed on the page or a card number in it can be replaced, and the bank should hear about the exposure.
For workflows still running, the fix belongs before the read: a bank-page task should run where a token replaces the account number before the model sees the screen, as How to Protect Data Before ChatGPT, Claude or Gemini Sees It sets out.
What does a governed environment change?
A governed environment changes what a stored image can contain. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers.On a rendered page, the values a policy names are replaced with consistent tokens before any model reads the screen, so an account page shows ACCT_001 to the agent while the bank's system still holds the real numbers. The conversation, and any screenshot kept with it, records the tokens.
The second change is where a real value resolves. It resolves only at an approved destination, at the moment of an approved action, so the agent can fill a payee field or submit a form without the model ever holding the account number. A named person approves each payment, submission or record change, and the approval carries a name and a time.
The third is the record itself. Every screen the model read, every action and every approval is exported to the organization's own monitoring, so what the agent saw has an answer that does not depend on a chat transcript. That export is what a retention schedule can be applied to, and what an auditor can compare with the bank's logs.
None of this changes the retired product's term; it changes what a session run today leaves behind. For the browser that replaced this one, see RedactSure vs ChatGPT Work: 2026 Comparison & Alternative.
What the record shows
The image a person worries about is a record of a rendered page, and the control that decides what it contains acts before the page renders. Where values are replaced with tokens before the model sees the screen, the chat holds ACCT_001 instead of an account number, and deletion becomes housekeeping rather than the only protection. Where they are not, the conversation is the record, and its life is the chat's life: kept until the conversation is deleted, with a 90-day purge behind that, on a retired product's help page (OpenAI, Atlas agent, 2026). The check is one search and one comparison. Open the account's chat history, search for the domain of a page that carries an account number, delete what matches and write down the date. Then take one live task on the same page and test what the model receives, by asking the environment for the screen as the model saw it.
Methodology and limitations
The page rests on OpenAI's help pages and research posts, two measured studies of web agents and language models, an OWASP entry, a Columbia DAPLab position paper and July 2026 press coverage of the retirement. Vendor pages were read between October 20, 2026 and October 27, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where a product applies its control and what it keeps, and these pages are the vendor's own account of both.
No product named here was tested for this page. A statement that a page does not cover something means the pages reviewed do not state it, not that the capability is absent; features change, and the page carries its date. The bank-page example describes a record type, not an organization.
Compliance determinations belong to the organization's counsel, its assessors and its own security and compliance officers. Nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
Did ChatGPT Agent keep screenshots of every screen it read?
Yes, for the screens it worked through. The help page states that screenshots were kept in conversation history until the conversation was deleted, and the takeover is the one place it says an image was not captured: when a person steps in to type a password or a code, screenshots were not taken, which "helps protect passwords" (OpenAI, ChatGPT agent, 2026). A page the agent read on its own was part of the record. The page describes a retired product, so treat it as the term that applied.
What happens to the record when I delete the chat?
Deleted chats leave the history, and the back-end copy is purged within 90 days, the only removal window the help page states (OpenAI, Atlas agent, 2026). The image has no delete control in the documentation, so deleting the conversation starts the clock. A copy exported or pasted elsewhere sits outside that path. Save the deletion date for the audit file.
Can other people read those screenshots?
Anyone who can open the conversation can open the image, because no separate permission for it is described. On a workspace plan that includes the administrators the plan documents, and on a personal plan anyone the chat was shared with. OWASP notes that personal information "may be disclosed during interactions with the LLM," and a screenshot is that disclosure in image form (OWASP, 2025). Treat the chat's audience as the image's audience.
Does the agent record a password typed during takeover?
No. The help page states that screenshots are not captured during takeover, which "helps protect passwords" (OpenAI, ChatGPT agent, 2026). That covers the moment a person takes the browser to type what the agent should not handle. It does not cover a password or card number already visible on a page the agent read, and it says nothing about what the takeover records. Ask about the session log when the credential matters.
How long does OpenAI keep the record of a deleted agent session?
Up to 90 days after deletion, by the only term the pages state (OpenAI, Atlas agent, 2026). The chat leaves the history at deletion and the back-end copy follows inside that window. The page gives no shorter period and no certification of erasure. For a bank account still open, 90 days is the number for the review, and the deletion date starts the clock.
What should a team ask about what the model receives from a screen?
The written term for what the model receives, not only what the agent may do. Ask which values a session keeps, whether an image of the page is stored, how deletion works and what period applies. Ask too whether values on the page can be replaced with tokens before the model reads the screen, because that answer decides what the chat holds. An agent that reads the account number stores it; one that reads a token stores the token.
How RedactSure Keeps an Agent Screenshot From Holding the Account Number
A screenshot of a bank page keeps every value the page rendered, and the old help page's only cleanup is deleting the whole conversation.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent opened the account page and the model received the account number and the balance, which the chat kept as an image. Inside the governed environment, the page renders as ACCT_001, a named person approves the transfer, and the real values resolve only at the bank's approved destination.
RedactSure is deploying now with enterprise and government customers. That help page kept screenshots until the chat was deleted, with a 90-day purge behind it.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
Anyone who ran the retired agent on a bank page can settle today whether that chat still holds the picture. Then see, with test values, what the model reads when the account renders as tokens instead. Book a demo