Can You Stop an AI That Reads Your Screen From Seeing Your Bank?

Yes, and the setting answers the wrong half

Every assistant that reads your screen now lets you exclude apps and websites. Microsoft Recall does. Littlebird does. ChatGPT's Computer History lets you choose the apps and sites it includes. So the answer to the headline is yes, and the yes tells you less than it seems.

An exclusion can be enforced in one of three places. The assistant can refuse to read the app at all. It can read the window, judge it on your Mac, and throw it away before anything is sent. Or it can send what it read to its servers and decline to store it there. All three show up in the settings as the same switch. Only the first two keep your bank balance on your machine.

What the vendors actually say

Microsoft's Recall page is the most specific. You can filter apps and websites, and a sensitive information filter is on by default, runs on the device, and stops a snapshot from being saved when it spots things like passwords or card numbers. It is also candid about the gaps. Website filtering works only in supported browsers and only for the tab in front. Content from a filtered site embedded in another page can still appear, and the filtered site's name can still show in your tab bar or history.

Littlebird's exclusions page says password managers are detected and excluded without setup, password fields are always ignored, and card numbers and API keys are redacted before being stored. Adult sites are excluded by default. Banking, social media, shopping, entertainment and health are categories you switch on yourself.

OpenAI's release notes say Computer History records interaction events, not screenshots, recordings or audio, that private browsing is not included, and that you choose which apps and sites it uses.

Notice what is missing. Littlebird says redacted before being stored, which is not the same as before being sent. None of the three pages tells you, for a website you add yourself, whether the page text left your machine before it was refused.

Where Driffle draws each line

Driffle reads the text of the app in front of you through macOS Accessibility, so it can answer questions about your work later. Its Settings show two lists, Exclude Apps and Exclude Websites, and the code treats them differently. We would rather you know which is which.

An app you exclude is never read. Driffle checks which app is in front before it reads anything, and if that app is on your list, the read does not happen. The same applies to a list of apps that are always refused for everyone: password managers, banking apps and health apps. No setting, plan or admin can turn that list off, and those rows show as locked.

Browsers are harder, because the address of a page is only known after the page is read. A page on the always refused list, such as a large bank, a sign in page or a patient portal, is read, judged on your Mac and dropped there. It is never queued and never uploaded. That list matches by address and by window title, and it is long, but it is not complete: a small local bank whose address and title match nothing on it is read like any other page.

A website you add yourself, and the categories you switch on (adult, social media, shopping and entertainment start switched on), are checked when the capture reaches Driffle's servers, and anything that matches is discarded without being stored. That page's text did leave your Mac. So the strongest setup is simple: do your banking in a second browser and exclude that browser as an app. Then nothing in it is read at all.

Two more details. Password fields are never read, and strings shaped like known API keys are blanked out on your Mac before upload. And Driffle does not currently treat a private browsing window differently from a normal one; the same site rules apply, nothing more.

Excluding an app is not muting it

If you also use the assistant to record meetings, check what an exclusion covers. In Driffle, excluding an app keeps its screen text out. It does not stop that app's sound from being recorded while a meeting is being captured, because call audio is taken from the whole Mac. To keep something out of a recording, pause capture. A pause lasts an hour by default and resumes on its own, and the Capture pane tells you when.

A five minute test before you trust any of them

Open the assistant's exclusion settings and find out which apps are refused without you asking. Exclude one ordinary app, use it for a minute, then ask the assistant what you were just doing in it. Open your bank in the browser you use every day and ask the same. Open a private window and do it again. Finally, ask the vendor one question in writing: for a website I exclude myself, does the page text leave my device before it is refused?

If the assistant answers a question about something you excluded, the switch is not doing what you think. If the vendor cannot answer the last question, assume the text leaves.

Driffle runs on Macs with Apple Silicon, and transcription and the AI run in the cloud, which is exactly why the line between dropped on your Mac and dropped on our server matters. If you want to run this test on it, download it at driffle.ai/download.