A note before the map. This is the fastest-moving area of these tools, with new ways of connecting them to your apps, browser and computer arriving every few months, so treat specifics as a snapshot. The principle underneath, that reach is granted one permission at a time, is the durable part.
The question arrives in two forms. The anxious one comes after reading about AI agents that book things and click around the web on your behalf: can this thing see my inbox, my files, the other tabs I have open? The hopeful one comes after watching a demo: can it read my documents without me pasting them?
The answer to both is the same, and it is more reassuring than the headlines and less magical than the demos. ChatGPT reaches exactly what you have connected, in the mode you are using, and nothing else.
The short answer. In an ordinary chat, ChatGPT sees what you type, paste or upload, and nothing on your computer, screen or browser. Connected apps extend that reach to the specific services you have linked, your email or files, and only once you link them. Agent and browser features can see the page they are working on and act within the browser, with confirmations on sensitive sites and without access to your wider system. Each step outward is a permission you granted, which means the honest answer to "what can it see" is whatever your connections list says, and most people have never opened it.
What it can reach, by mode
| What you are doing | What ChatGPT can reach | What it cannot |
|---|---|---|
| An ordinary chat | What you type, paste or upload in that conversation, plus your memory and instructions | Your files, screen, other tabs, other apps |
| A chat with connected apps | The specific services you linked, such as a mail account or a file store, when the conversation calls on them | Any service you have not connected |
| Agent or browser mode | The page it is working on, and the ability to click, scroll and open tabs within that browser session | Your wider system, your files outside the browser, downloads or code on your machine |
| A work account | What your employer's configuration allows, which may include company documents and tools | Anything outside the workspace's permissions, which an administrator controls |
The pattern across all four rows is the same. Reach grows by explicit connection, never by default, and an ordinary chat remains an ordinary chat however many agent features exist elsewhere in the product.
Agents are arriving across every tool, not just ChatGPT, and they are easier to judge once you can tell them apart. Claude Cowork vs Claude Code vs chat lays out the same distinction on Anthropic's side, between a conversation, a tool that works through your files and one that writes code.
The two anxieties, answered properly
- Can it see my screen or my other tabs? Not in an ordinary chat, which only ever sees what you put into it. Browser and agent features see the page they are working on, which is the one you asked them to work on, and they pause for confirmation on sensitive sites such as banking. They do not scan your other tabs or your desktop, and the remaining ways it can see your screen are ones you start yourself, such as sharing it during a voice conversation in the mobile app. The newer features are powerful, but they are powerful inside a fence you can see.
- Can it read my files? Only the ones you upload to a conversation or a Project, and only the files in a service you have deliberately connected. It cannot browse your hard drive. The hopeful version of the question does have a real answer, though: connecting a file store lets it read documents without pasting, which is useful and also the moment to think about what is in that store. The tasks you should never give ChatGPT covers which material belongs nowhere near a consumer account.
The two habits that keep the boundary where you want it
- Open the connections list. Every tool has a page showing which apps and services you have linked, and it is worth a slow read. Most people find one or two connections they made during a trial and forgot, and the right move is to disconnect anything you are not actively using, because a connected mailbox is readable whether or not you remember connecting it.
- Keep work accounts off personal AI. The most common real exposure is far duller than an agent gone rogue: a personal ChatGPT account connected to a work email or drive, which puts company material inside a consumer tool with no agreement behind it. Work connections belong in a workspace your employer controls, and personal accounts connect to personal things. What the company side can see in return is its own question, answered in can your employer see your ChatGPT?
The honest frame
The newer features are more capable and reach further than anything before them, and both facts are true at once. The protection lies in knowing that every increase in reach is a permission with your name on it, rather than in avoiding the features altogether.
Check the list that records those permissions once a quarter, and connect the tool to the things the task actually needs and not one thing more. Set up that way, the agent features are a useful colleague with a key to one room, which is exactly what they should be.
Not sure where to start?
Know what it can reach. Then pick the tool.
The free finder tells you which AI to open for the task in front of you, in about 60 seconds, and the full “AI, sorted.” reference lands in your inbox.
Try the free finder →One question in, one answer out.
Clair helps non-technical professionals know when to trust their AI, when to check it, and when to skip it.