OpenAI has introduced an Apple Messages plugin that lets ChatGPT search iMessages, summarize conversations and send texts from a user's Mac, but the integration requires one of macOS's broadest privacy permissions, potentially giving the application access to protected data well beyond the Messages database.
Released Thursday for all ChatGPT plans, the plugin operates on Apple Silicon Macs through ChatGPT Work and Codex rather than ordinary ChatGPT conversations, the web interface or mobile apps. Users must grant Full Disk Access as well as permissions covering contacts and application automation before the integration can perform its core functions.
The result is a significant expansion of what ChatGPT can do on a personal computer. Users can ask it to search previous conversations, catch up on lengthy threads, prepare and send replies, identify possible spam, locate birthdays mentioned in messages or coordinate meeting times by comparing conversations with calendar information.
The integration supports iMessage, SMS and RCS conversations handled through Apple's Messages application. OpenAI product staff member Ari Weinstein promoted the ability to analyze messages for broader insights into whom users communicate with and the subjects they discuss.
The privacy trade-off comes from the way macOS protects the underlying data. Messages delivered to a Mac are decrypted and stored locally in a database inside a protected directory. Accessing that database requires Full Disk Access, a system-level permission that isn't limited to Messages.
That means a user can't authorize ChatGPT to reach the Messages database while separately blocking access to other protected locations covered by the same permission. Full Disk Access can encompass data associated with Mail and Safari, Time Machine backups and certain administrative information.
The distinction is also important for users who assume iMessage's end-to-end encryption prevents third-party software from examining their conversations. The encryption protects communications while they are transmitted and stored within Apple's infrastructure; once a message has arrived and been decrypted on an authorized Mac, software with sufficient local permissions can potentially access the locally stored information.
The integration relies on AppleScript and Apple's automation framework rather than a dedicated Messages API, according to MacRumors. AppleScript allows applications to issue commands to other Mac applications through Apple Events, requiring users to grant an additional Automation permission.
Apple's role in developing the ChatGPT integration is unclear, MacRumors reported. Because Apple doesn't offer an official API providing this type of third-party Messages access, the plugin's architecture differs from integrations built around narrowly scoped APIs designed specifically for outside developers.
OpenAI has attempted to limit one of the most consequential risks-the ability of AI software to communicate while impersonating the user-through a confirmation mechanism. Under the default configuration, ChatGPT presents the proposed message and its recipients before transmission and requires the user to approve the action.
OpenAI describes that confirmation as the user's final opportunity to inspect a message before ChatGPT sends it on the user's behalf and recommends leaving the safeguard enabled.
There is an important exception. OpenAI's release documentation identifies a known issue involving scheduled tasks, which can disable the per-message approval prompt. That creates circumstances in which an automated workflow involving Messages could send communications without the same confirmation step that applies during ordinary use.
The permission model highlights a broader security challenge emerging as technology companies turn AI assistants into agents capable of taking actions across personal applications. Such systems become more useful as they gain access to communications, calendars, documents and other private information, but every additional permission also increases the amount of sensitive data potentially exposed if the software malfunctions or its security is compromised.
Signal President Meredith Whittaker warned about that trade-off while discussing agentic AI at SXSW in 2025, describing the model as effectively "putting your brain in a jar" because useful agents require extensive access to users' personal information.
IEEE Senior Member Vaibhav Tupe has similarly argued that highly capable agents could require access across areas ranging from financial and medical information to calendars, location histories, communications and shopping behavior. Gartner has forecast that agentic AI misuse could eventually be involved in one-quarter of enterprise security breaches.
The Messages rollout comes as OpenAI and Apple are also confronting each other in court. Apple sued OpenAI in the Northern District of California in July, alleging a scheme involving confidential hardware information taken by former Apple employees who joined OpenAI. OpenAI President Greg Brockman rejected the broader implication in a July 29 interview with The Wall Street Journal, saying the company is "plenty innovative" and has no interest in competitors' trade secrets.
OpenAI says the Messages plugin operates locally and doesn't create a persistent index containing a user's entire message history. The company hasn't provided more extensive public technical documentation detailing every stage of how conversation information is handled after a user directs ChatGPT to process it.
