ChatGPT Apple Messages plugin for Mac

OpenAI's new plugin turns the ChatGPT desktop app into an agent that can read, search, draft, and send iMessage, SMS, and RCS conversations on Apple silicon Macs ^[1]. Getting there requires macOS Full Disk Access plus separate permissions for Contacts and Automation - a broader grant than most users clock, since Full Disk Access technically opens the door to Mail, Safari history, and Time Machine backups as well, not just the Messages database ^[2].

The headline safeguard is that ChatGPT asks for approval before sending anything by default, letting the user review both the message text and the recipient first. But that safeguard has two documented cracks: OpenAI itself discourages turning on persistent, always-allow approval ^[1], and its own release notes acknowledge that certain scheduled or automated tasks can disable the per-send prompt entirely ^[3]. In other words, the plugin's core privacy promise - a human checks every outgoing message - is opt-out by design in at least some configurations, not a hard guarantee.

The timing is hard to ignore. On July 10, 2026, Apple sued OpenAI alleging trade-secret theft tied to hardware development, claiming as many as 13 former Apple employees passed along confidential product details and pointing to more than 400 ex-Apple staff now working at OpenAI ^[4]. OpenAI publicly rebutted the allegations in early August, saying it had seen no evidence supporting Apple's claims ^[5].

Six weeks later, OpenAI shipped a plugin that reads and sends messages through Apple's flagship encrypted messaging service - built entirely on Apple's own automation frameworks (AppleScript and Accessibility APIs) rather than any sanctioned Apple API ^[3], with no indication OpenAI needed or received Apple's cooperation. Apple has precedent for shutting this kind of access down: it blocked Beeper Mini, an Android app that tapped into iMessage, within days of its 2023 launch ^[6]. Whether Apple treats a ChatGPT plugin the same way - especially mid-litigation - is the open question hanging over the release.

OpenAI frames the plugin as privacy-conscious: it says the feature runs locally on the Mac, relies on existing macOS automation rather than shipping data to a new backend, and does not build a persistent index of a user's full message history ^[7]. That framing sits uneasily next to the mechanics above - a system that, by OpenAI's own admission, can send on a user's behalf without a fresh approval prompt under some settings.

It also doesn't resolve a separate consent problem: once one participant in a thread enables the plugin, everyone else in that conversation has their messages summarized and processed by an AI they never agreed to and likely don't know is involved. Community reaction has been mixed but weighted toward skepticism, with much of the pushback focused less on whether the feature works as described and more on whether 'local processing' is precise enough language for what a cloud-hosted assistant is actually doing with message content once a user asks it a question - though not every response has been negative, with at least one power user describing a similar read-access AI integration as a genuinely useful 'single source of truth' for managing work communications.

Part of the calculation looks competitive. AppleInsider's William Gallagher argued the plugin's convenience doesn't justify its privacy risk, pointing out that Apple's own upcoming AI-enhanced Siri is expected to offer similar message-search capability without routing a user's texts through a third party ^[6]. Shipping now - on Apple silicon Macs, inside ChatGPT's desktop app - lets OpenAI put a message-aware assistant in front of users before Apple's native equivalent arrives, using the one channel Apple can't easily wall off without breaking its own automation stack.

The multi-step permission setup (Full Disk Access, Contacts, Automation, explicit send approval) does mean, as one report noted, that nobody ends up with this enabled by accident ^[8]- but it also means OpenAI is asking users to extend trust to a still-litigating rival over a platform that has spent years marketing itself on exactly this kind of message privacy.