Claude Desktop's "computer use" feature takes screenshots of your display and feeds them to a vision model. Microsoft Copilot Vision does the same. Dozens of agent tools now claim to "use your computer like a human." They do not use APIs. They do not read accessibility trees. They capture the frame buffer and OCR everything.
But the vision model is only half the story. The other half is metadata extraction through Windows APIs that require no screen capture permissions at all.
The DWM Thumbnail API: Zero-Permission Surveillance
Windows Desktop Window Manager provides thumbnail APIs that generate live previews of all windows. These are the same previews you see in Alt-Tab and the taskbar. Any process can enumerate every window handle, extract its title, read its process name, and determine its visibility state — without ever capturing a pixel.
This is not a vulnerability. It is a documented Windows feature. And AI agents are using it to build activity profiles that are more structured and more machine-readable than screenshots alone.
A screenshot tells an AI what your screen looks like. Window metadata tells it what you are doing, who you are talking to, which applications you use, and what documents you have open. The metadata is lighter to transmit, easier to parse, and harder for the user to detect.
What AI Agents Actually Extract
From DWM enumeration alone, an AI agent can learn:
- Which applications are running and for how long
- The titles of every browser tab, document, and chat window
- Whether specific windows are minimized, maximized, or focused
- The sequence of window focus changes over time
- Which monitor each window occupies
From screenshot OCR, the agent can cross-reference this metadata with visible text. A window titled "Gmail — Offer from Anthropic" combined with OCR of the visible email body creates a complete intelligence profile.
Why This Matters More Than Screen Capture
Screen capture is obvious. It requires permissions. It triggers security alerts in some environments. DWM enumeration requires no special permissions for a process running in the same user session. It is silent. It is continuous. And it is completely invisible to the user.
An AI agent that enumerates windows every five seconds and screenshots every thirty seconds has a more complete picture of your activity than either method alone. The metadata provides context. The screenshots provide content.
Title Masking as a Defense
Title masking in NoCapture rewrites window titles before they reach the DWM and shell APIs. "Slack — Recruiter: Offer letter" becomes "Untitled Application." The AI agent still sees that an application is running. It no longer sees the conversation partner or subject.
This is not a complete defense. A determined attacker with system access can still identify the process by executable name or memory inspection. But against the bulk surveillance model used by AI agents — enumerate everything, filter later — title masking removes the signal that makes the enumeration valuable.
We wrote about how to mask window titles here.
The Broader Implications
As AI agents become standard productivity tools, the desktop is no longer a private workspace by default. Every window title, every tab name, and every notification is potentially ingested into a model's context window. The "local AI" label is misleading. The inference may run on your machine. The observations are still exported to cloud dashboards, session replays, and training data pools.
We wrote about the full implications of AI screen capture here.
What Users Can Do
- Cloak sensitive apps from the capture stream so vision models cannot read their content
- Mask their titles so enumeration APIs cannot identify their purpose
- Suppress notifications so banners do not reveal activity
- Use live preview to verify what AI agents would see if they captured the screen
- Limit AI agent permissions where possible, though many agents require broad access to function
The Limitation
Title masking protects against enumeration and casual observation. It does not protect against a process that reads memory directly or hooks the application internally. That level of protection requires application-level security, not OS-level privacy tools. NoCapture addresses the capture and enumeration layer. It does not claim to defeat forensic-level analysis.
We wrote about the three layers of screen-share privacy here.
NoCapture provides OS-level window cloaking, title masking, and notification shielding for Windows. Free for two windows. Because "being careful" isn't a strategy.
