BLUF: the newest AI-product releases matter less as feature news than as a boundary-design test. Persistent activity context, lower-latency agent models and browser action all expand the amount of enterprise context a model can see or act upon. Teams should treat each capability as a scoped integration: named data sources, explicit actions, audit evidence and a fast revocation path.
Persistent context is a data-governance decision
OpenAI has added Computer History to the ChatGPT macOS app. The optional feature lets ChatGPT and Codex reference selected activity from applications and websites. OpenAI says it records interaction events rather than screenshots, screen recordings or audio; private browsing is excluded. It is off by default. For Business and Enterprise workspaces, an administrator must first grant access. The feature is not currently available in the EEA, the UK or Switzerland.
That availability boundary is operationally useful: it prevents an accidental rollout in Germany, but it is not a substitute for a policy. “Interaction events” can still reveal customer names, application names, document titles, workflows and sensitive business context. Before any equivalent capability is enabled, define which managed endpoints and applications are in scope; prohibit personal accounts; set retention and deletion expectations; and nominate the evidence owner. A data-protection and works-council review may be required for a concrete deployment; this is not legal advice.
The control pattern is the same as in data governance for high-risk AI: prove lineage and make deletion and access decisions testable.
Cheaper, faster models raise the release-management bar
Google has announced Gemini 3.6 Flash, Gemini 3.5 Flash-Lite and Gemini 3.5 Flash Cyber for production agent workloads, positioning the family around token efficiency, latency and reliability. The enterprise implication is not that a smaller or faster model is automatically safer to deploy. A lower unit cost often makes it economical to invoke a model more frequently, across more steps and with more tools. That increases the number of decision points, model versions and failure paths that must be observed.
Procurement should therefore require a model-release bundle before a routing change: exact model identifier, region and service terms; a representative evaluation set; latency and cost ceilings; fallback behaviour; and rollback criteria. Run the proposed model against the same permission-filtered retrieval corpus and tool-policy suite as the incumbent. If output quality, refusal behaviour or structured-output conformance changes, treat it as a production change rather than an SDK upgrade.
A practical baseline is a reproducible and reversible LLM release bundle—particularly when model aliases or routing defaults can move underneath an application.
Browser agents belong behind an action boundary
Anthropic has expanded Claude for Chrome and describes browser-use defenses that scan untrusted content, apply classifiers and use improved model behaviour. Its accompanying security research is appropriately cautious: a one-percent attack success rate is still meaningful risk, and every page, document, advertisement or dynamically loaded element can contain adversarial instructions. That is the right lens for all browser agents, not just one vendor.
Do not give a browser agent broad, ambient authority over a logged-in employee session. Start with a disposable browser profile, an allowlist of low-risk internal sites, read-only tasks and a service account with minimum privileges. Keep approval gates in front of external submission, deletion, payment, permission changes and downloads. Capture the task request, pages visited, proposed action, approver and final result in an audit trail. Where a task touches customer, employee or regulated data, confirm data residency and subprocessors before enabling the connector.
This turns prompt injection from a model-only concern into an operating control, consistent with treating retrieved documents as untrusted input.
The practical decision
For the next thirty days, select one browser-assisted workflow with no irreversible action: for example, collecting structured data from an approved internal portal. Measure completion rate, human-intervention rate, blocked injections, latency and cost. Do not scale based on a demonstration. Scale only when the team can show that permissions, data flows, model versions and approvals remain understandable after an incident. That is how newer capabilities become useful enterprise systems rather than a larger, harder-to-audit attack surface.
Primary sources
OpenAI, ChatGPT Release Notes.
Google, Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber.
Anthropic, Mitigating the risk of prompt injections in browser use.
