OpenAI shipped an Apple Messages plugin for ChatGPT on Mac on August 20, 2026. It reads your iMessages, SMS, and RCS chats, drafts replies in your voice, and sends texts on your behalf — but only after you hand it Full Disk Access, a permission that reaches well past your Messages folder.
We installed it, dug through the permission prompts, and read what OpenAI’s own plugin guide admits about the risks. Here’s what it actually does, what it costs you, and whether it’s worth the trade.
What Is the ChatGPT Apple Messages Plugin?
The Apple Messages plugin is a native integration inside the ChatGPT desktop app for Mac that lets ChatGPT read, search, summarize, draft, and send messages across iMessage, SMS, and RCS. It’s built into ChatGPT Work and Codex mode, and it works by connecting directly to the same message database your Messages app already uses.
Think of it less as a chatbot feature and more as ChatGPT getting a set of hands on your Messages app. You tell it what you want — “catch me up on the group chat” or “reply to Sarah with a few times I’m free Thursday” — and it goes and does that, inside your actual Messages app, using your actual message history.
How Does It Work?
ChatGPT doesn’t intercept iMessage’s end-to-end encryption, because it doesn’t need to. Once a message lands on your Mac, it’s already decrypted and sitting in a local SQLite database at ~/Library/Messages/chat.db. That’s how Spotlight search and every other Mac app that touches Messages has always worked — ChatGPT is just the newest one reading from it.
To get there, OpenAI’s plugin uses AppleScript and macOS Accessibility tools, the same automation layer that Keyboard Maestro or any Mac scripting tool relies on. Nothing about the mechanism is exotic. What’s new is which company is now allowed to look.
Setup Requirements
Getting the plugin running means handing ChatGPT four separate permissions:
- Full Disk Access — a broad macOS permission that covers far more than Messages; it also touches Mail data, Safari history, and Time Machine backups on the same account
- Contacts access — so ChatGPT can match phone numbers to names instead of showing you raw digits
- Automation permissions — needed to actually type and send inside Messages
- Explicit opt-in inside ChatGPT — a permissions screen that spells out what’s being accessed before anything happens
That first one is the sticking point. Full Disk Access is an all-or-nothing macOS setting. You can’t grant ChatGPT read access to just the Messages database — you’re opening the same door that gives an app access to nearly every protected file for every user on that Mac.
Which Devices and Plans Support It?
This is where the plugin gets narrow fast.
Supported:
- Apple Silicon Macs only (M1 and later)
- ChatGPT Work and Codex modes, inside the desktop app
- All ChatGPT subscription tiers, including the free plan
Not supported:
- Intel Macs
- ChatGPT’s web interface at chatgpt.com
- The iPhone or iPad ChatGPT apps
- Regular ChatGPT chat mode — it only runs inside Work and Codex
So if you’re on an older Intel MacBook, or you mostly use ChatGPT on your phone, this feature doesn’t exist for you yet. And texting your Mac to trigger a ChatGPT command doesn’t work either — the integration is one-directional. ChatGPT can act on Messages; Messages can’t wake up ChatGPT.
What Can It Actually Do?
OpenAI’s own suggested prompts give a good sense of the intended use case. Things like asking it to check your calendar and text someone a few open times for dinner next week, or asking it to summarize everything you missed in a group chat since yesterday.
Beyond that, the plugin can:
- Search your message history for a specific detail from weeks or months back
- Summarize long or busy threads in a few sentences
- Draft replies that match the tone of the conversation
- Send messages — with approval required by default
- Delete messages on request
- Analyze patterns across your conversations — who you talk to most, what topics come up
That last one is worth sitting with. OpenAI product staffer Ari Weinstein described being able to pull insights about who you talk to and what you talk about as one of the fun parts of the feature. Useful for some people. For others, that’s the exact sentence that makes them close the settings panel.
The Privacy Trade-Off Nobody’s Framing Correctly
Most coverage of this launch leads with “OpenAI can now read your texts” and stops there. That undersells the actual issue.
iMessage’s encryption was never the thing at risk here — it does its job in transit and on Apple’s servers. The real story is that Full Disk Access is a bundle deal. You’re not granting ChatGPT a Messages-only key. You’re granting it the same tier of access as a backup tool or a forensic recovery app, on the theory that it will only touch what you ask it to touch.
OpenAI’s defense, repeated across every outlet we checked, breaks down into three claims: the plugin runs locally, it doesn’t build a standing index of your messages, and ChatGPT only reads a thread when you specifically ask it to. Those are meaningful guardrails, and they’re also not the same as the plugin being narrowly scoped by macOS itself — the operating system’s permission model doesn’t distinguish “read Messages” from “read everything.”
By default, sending a message still requires your manual approval — you see the exact text and the exact recipient before anything goes out. OpenAI explicitly warns against turning on persistent approval for any chat that could contain misleading instructions, because that setting removes your last chance to catch a mistake before it’s sent.
Apple hasn’t officially responded to the plugin, and the timing is awkward: the launch lands in the middle of an active lawsuit between Apple and OpenAI over alleged trade secret theft. Apple has a track record of shutting down unauthorized iMessage bridges — it repeatedly cut off Beeper Mini’s access in 2024 until the developers gave up. Whether Apple treats this differently because it uses sanctioned automation tools instead of a reverse-engineered protocol is still an open question.
How to Set Up the ChatGPT Apple Messages Plugin
- Update ChatGPT for Mac to the latest version and confirm you’re on Apple Silicon
- Open the Plugins section inside the ChatGPT desktop app and find Apple Messages under Public plugins
- Switch to Work or Codex mode — the plugin won’t appear in a standard chat
- Follow the permissions screen and approve access to your Messages history
- Open System Settings and turn on Full Disk Access for ChatGPT, plus Contacts and Automation
- Leave manual send-approval turned on — don’t switch to persistent approval unless you fully trust every thread it might touch
Should You Actually Turn It On?
If you live inside ChatGPT for work and you’re constantly context-switching to check a group chat or dig up an old message, this saves real time — that part is genuinely convenient. If the idea of one company holding Full Disk Access to your Mac in exchange for text-summarizing convenience makes you uneasy, that instinct isn’t overblown. The permission really is that broad, and it stays that broad for as long as the plugin is enabled, not just during the moments ChatGPT is actively reading a thread.
Our take: enable it on a Mac you don’t mind exposing broadly, keep manual send-approval on always, and skip it entirely on a shared or work-issued machine where Full Disk Access touches more than just your own data.
FAQ
Q1: Does the ChatGPT Apple Messages plugin work on iPhone? A1: No. It’s currently Mac-only, and only on Apple Silicon Macs. It doesn’t run in the ChatGPT iOS app, the web version, or on Intel Macs — OpenAI hasn’t said whether phone support is coming.
Q2: Can ChatGPT read my iMessages without me asking? A2: OpenAI says no — the plugin doesn’t build a running index of your messages, and it only reads a thread when you specifically prompt it to. It runs locally rather than continuously scanning your inbox in the background.
Q3: Does Full Disk Access mean ChatGPT can see my Mail and Safari data too? A3: Technically yes. Full Disk Access is a single macOS permission that covers protected files broadly, including Mail data, Safari browsing history, and Time Machine backups — not just the Messages database. OpenAI says it only accesses what a request calls for, but the permission itself doesn’t enforce that boundary.
Q4: Will ChatGPT send messages without my approval? A4: Not by default. You have to approve both the message text and the recipient before anything sends. OpenAI does let you turn on persistent approval for a specific chat, but it warns against doing that, since it removes your final check before a message goes out.
Q5: Does this bypass iMessage’s end-to-end encryption? A5: No. iMessage encryption protects messages in transit and on Apple’s servers. Once a message reaches your Mac, it’s already decrypted and stored as a local file — that’s the layer the plugin reads from, the same way Spotlight or Time Machine already can.
Q6: Is there a similar plugin for SMS and RCS, or just iMessage? A6: All three. The plugin works with anything that shows up in the Messages app — iMessage, SMS, and RCS conversations — not just blue-bubble chats.
