ChatGPT Can Now Read and Send Your iMessages: OpenAI's Boldest Privacy Gamble Yet

On August 20, 2026, OpenAI quietly shipped one of the most aggressive product decisions in its history: an Apple Messages plugin for the ChatGPT desktop app on macOS. Once enabled, ChatGPT isn’t just a chatbot in another window anymore — it can search your entire message history, summarize conversations, draft replies, and, with your approval, send texts as you across iMessage, SMS, and RCS.

It is simultaneously the most useful thing ChatGPT has done for everyday communication and the deepest an AI assistant has ever reached into a private, encrypted-by-default corner of Apple’s ecosystem. Within hours of launch, the story had split cleanly in two: a productivity breakthrough on one side, a privacy and control debate on the other.

What the plugin actually does

According to OpenAI’s documentation and coverage from TechCrunch, the plugin gives ChatGPT a working interface into the macOS Messages app:

• Search and retrieval — ask ChatGPT to find information “buried deep in your message history,” like an address a friend sent weeks ago or the name of that restaurant your group chat argued about.
• Summarization and catch-up — the model can digest long threads and brief you on what you missed, one conversation or many at a time.
• Drafting and sending — ChatGPT can compose a reply and, after you review it, send it through Messages on your behalf. A demo commercial shows a user asking the bot to suggest follow-up messages based on yesterday’s conversations.
• Deletion — you can also ask ChatGPT to delete messages for you.
• Professional use — the plugin works with Codex and ChatGPT Work, so this isn’t positioned as a purely personal toy; OpenAI clearly expects it in workflows.

Initially the feature is rolling out to ChatGPT Work and Codex users on Mac, with broader availability expected to follow. The asymmetry is telling: the users most likely to hand an AI their message archive are the ones already paying for the professional tier.

The permission stack — and why it raised eyebrows

To function, the plugin requires a genuinely heavyweight set of grants, as Engadget and Bloomberg detailed:

1. On-device Messages history access — approved through a permissions popup during setup.
2. Full Disk Access — enabled manually in System Settings, the same macOS permission tier that gives an app the ability to read and write files across your disk.
3. Contacts access and automation permissions — so the model can resolve names and act on conversations.

“Full Disk Access” is the phrase that made security writers sit up. It’s the macOS permission historically associated with backup tools, disk utilities, and malware. Handing it to a networked AI application — however reputable — is a categorically different trust decision than granting a note-taking app access to one folder.

OpenAI’s responses to press inquiries leaned on three mitigations. First, ChatGPT does not create a full index of your messages; reading happens when you make a specific request. Second, the plugin’s local component runs on your device. Third, sending requires per-message review by default — and OpenAI explicitly discourages turning on persistent approval, warning that doing so “removes your final chance to review a message before ChatGPT sends it as you.”

That last warning is remarkable in itself: OpenAI knows some users will disable the friction, and it’s telling them, in writing, that the friction is the safety feature.

What remains unclear

Reporters who pressed for details found the retention story fuzzier than the launch blog implied. TechCrunch notes that “the full context about what sort of information gets retained by ChatGPT isn’t totally clear.” If message content transits to OpenAI’s servers during processing — even transiently, even without indexing — the privacy calculus changes materially from a purely local tool. OpenAI says the plugin runs locally on-device, but the model completing your “summarize this thread” request is not a small local model, and the company hasn’t fully detailed which parts of a request stay on the Mac.

There’s also the question of exfiltration risk at scale. A tool that can read your messages and send messages is, in security terms, a tool that can leak your messages — one convincing prompt injection, one compromised plugin update, and the channel between those two capabilities becomes an attack path. OpenAI’s per-message review is the control that stands between a clever adversary and your contact list.

The awkward context: Apple and OpenAI are fighting

This launch doesn’t happen in a vacuum. Apple and OpenAI are currently locked in a trade-secrets lawsuit — Apple escalated the case earlier this month, and OpenAI publicly fired back on August 3 with a post titled “Apple is getting this wrong,” publishing internal message exchanges to rebut claims. The two companies are, to put it mildly, not on friendly terms.

That makes the Messages plugin a curious artifact. Engadget points out it’s unclear whether OpenAI coordinated with Apple at all — and Apple has a documented history of cutting off third parties that touch iMessage without permission, most famously the Beeper Mini saga in 2024, where Apple repeatedly disabled the startup’s iMessage bridge until Beeper gave up.

The plugin works locally through macOS accessibility and disk permissions rather than an official Apple API, which means it exists at Apple’s tolerance. If the relationship deteriorates further, a macOS update could break it — or Apple could decide an AI reading iMessage archives crosses a line its lawyers want drawn in court rather than in System Settings.

Why this matters beyond Mac users

Strip away the platform specifics and this launch marks a threshold: a frontier AI company now treats your default messaging app as an agent workspace. The previous wave of integrations — email triage, calendar management, browser control — dealt with information that was already largely operational, already semi-professional. Messages are different. They’re the rawest, most context-rich record of your personal relationships most people possess, and they’re protected (psychologically, at least) by the blue-bubble promise of end-to-end encryption.

The plugin also previews the coming battle over AI intermediaries. If ChatGPT summarizes, prioritizes, and increasingly answers your messages, it becomes the interface to your social life — the layer that decides what deserves attention and what your reply sounds like. That’s a strategically priceless position, and it’s the same position Google built with Gmail’s Smart Reply and Apple is presumably building with its own delayed Siri overhaul. OpenAI just got there first on Apple’s own platform, using permissions Apple gives any app that asks.

The counterweight is trust. The Census Bureau’s recent workplace-AI survey showed adoption is broad but uneven; plugins like this will widen the gap between AI-optimists who connect everything and skeptics who connect nothing. For OpenAI, still working through the aftermath of the rogue-agent incident that slowed its training pipeline this month, the plugin is a statement that it believes consumers will trade disk-level access for convenience — and a bet that Apple won’t, or can’t, stop it.

Whether that bet pays off may say more about the next phase of consumer AI than any benchmark release this year.

Sources

• TechCrunch — ChatGPT can now send texts for you with new Apple Messages plug-in
• Engadget — ChatGPT on Mac can now read and respond to Apple iMessages
• 9to5Mac — ChatGPT update adds Apple Messages integration on Mac
• Unite.AI — ChatGPT Plugin Reads and Sends Apple Messages on Apple Silicon Macs
• OpenAI Help — ChatGPT Business Release Notes