The pitch is deceptively simple: ChatGPT reads your unread threads, drafts a reply to your boss, and waits on your approval to send—all before your coffee gets cold. That’s the actual premise behind OpenAI‘s Apple Messages plug-in, launched August 20, 2026, for the ChatGPT macOS desktop app. The chatbot can now read, search, summarize, draft, delete, and send iMessage, SMS, and RCS conversations—but only inside Codex and ChatGPT Work sessions, and only on Apple silicon Macs. The feature is genuinely useful. The tradeoffs are equally real.
What It Actually Does
A messaging agent that lives inside your Mac, not just your browser.
The plug-in’s scope is broader than most AI assistants manage. It reads and searches your iMessage, SMS, and RCS history, surfacing buried commitments—dates, addresses, that dinner reservation your friend texted three weeks ago. It drafts follow-up messages based on prior conversations and sends them on your behalf after you approve. It can delete messages too. Standard ChatGPT chats get none of this; the feature is locked to Codex and ChatGPT Work sessions only.
Hardware matters here. Intel Mac users are locked out entirely. No web version, no mobile app, no CLI. Apple silicon or nothing.
“As with most things related to AI, this new feature raises some privacy questions.” — TechCrunch
The Permission Price Tag
Full Disk Access is not a small ask.
To make any of this work, you hand ChatGPT three levels of system access:
- Full Disk Access
- Contacts permission
- Automation control via AppleScript and Accessibility APIs—macOS’s deepest system hooks
OpenAI says the plug-in runs locally and, according to Bloomberg, “doesn’t create an index of all someone’s messages.” Reassuring, on the surface. But TechCrunch flags that the specifics of what local processing actually means “aren’t immediately clear.” That gap between the promise and the explanation is exactly where scrutiny belongs.
By default, ChatGPT requires your explicit approval before sending anything—you review the content and the recipient first. Sensible enough. But OpenAI also offers “persistent approval,” a setting that lets the AI send to designated chats without asking every time. Think of it like handing your most trigger-happy group chat over to an autocorrect that never sleeps. OpenAI’s own documentation warns against it directly: persistent approval “removes your final chance to review a message before ChatGPT sends it as you.” That’s the company flagging its own feature’s risk. Take the hint. And it’s worth remembering how iCloud left Apple’s confidential files exposed to ex-employees—a reminder that deep system access on Apple platforms carries its own history of data exposure.
Bloomberg frames this as having “the potential to raise privacy concerns for the iPhone maker”—notable tension given Apple’s privacy-first brand identity.
Worth It, With Eyes Open
Useful tool. Serious decision. Don’t rush the install prompt.
For Apple silicon Mac users deep in Codex or ChatGPT Work workflows, this plug-in addresses a real problem—managing high-volume messaging without losing the thread. The productivity case is solid. But granting an AI agent Full Disk Access to your most personal conversations deserves more deliberation than a permission pop-up allows—especially given what a purpose-built surveillance app can do when messaging access is weaponized. Keep persistent approval off. Read every draft before it sends. The feature works best when you stay in the loop.
