ChatGPT Gets iMessages—At What Cost?

ChatGPT can now read, search, and send texts from Apple Messages on your Mac—if you grant it the keys.

Story Snapshot

The Mac app can read and search iMessage, SMS, and RCS, and send replies for you.
Using it requires Full Disk Access, contacts, Accessibility, and automation permissions.
OpenAI says it runs locally via macOS Accessibility and can be disabled anytime.
Persistent approval can remove the final “Are you sure?” before sending.

What the new Messages feature actually does

OpenAI’s desktop app for Mac adds a Messages hook that can read and search your iMessage, SMS, and RCS threads on that Mac. It can also draft and send messages through the Messages app. Computerworld reports the feature lives in the desktop app’s Work and Codex modes, not in regular chats, and that it can send on your behalf once you approve the text. This turns ChatGPT into a powerful inbox triage tool that can find missed pings and craft fast replies.

Apple’s own support materials describe a system-level way to use the ChatGPT extension with Apple Intelligence, with a clear rule: you choose what to send. Apple says the user decides what content goes to ChatGPT each time, which aligns with an approval-first model. That line matters. It sets the norm that the assistant should not ship your private words without a human in the loop. It also hints at how Apple expects third-party assistants to behave on macOS.

The permission wall you must climb

To make this work, you must grant sweeping macOS rights. Reports say you will be prompted for Full Disk Access, your contacts, and automation tools, and you must enable Accessibility so the app can query on-screen content. OpenAI’s help page confirms the use of the macOS Accessibility application programming interface and explains you can shut the feature off by revoking that permission. These are not small asks. They unlock broad reach across apps and files when granted.

Full Disk Access lands with a thud because Apple defines it as access to all files, including data from Mail, Messages, Safari, Home, and Time Machine backups. That is why users react fast when any assistant asks for it. While one article claims the plugin’s scope could extend across Mail, Safari, and backups through that setting, the most solid, on-record facts here remain the permission prompts themselves rather than a proven sweep of every data category. Prudence says treat the scope as wide until you narrow it.

Local processing claims meet real-world risk

OpenAI says the Messages integration runs on your Mac, does not build a full index of all your texts, and requires your approval before sending by default. The help docs add that the Accessibility permission gates the feature and can be turned off at any time. Those are good guardrails on paper. But policy is not physics. When you grant deep system access, the blast radius grows, even if the app behaves well most days. Trust is earned by audits, not slogans.

ChatGPT plugin for Apple Messages: Imagine using Signal for a private conversation specifically because you don’t want anyone outside that conversation to read it.

Think Signal when considering the privacy implications, not SMS or email.

Apple Messages supports 3 services:

1.…

— Paul Walsh (@Paul__Walsh) August 23, 2026

One more toggle raises eyebrows. Reporting cites a “persistent approval” mode that can remove the final review step before a message sends. If enabled, the assistant can draft and fire without that last human glance. That flips the risk model from “read and suggest” to “act now, fix later.” Conservative common sense says do not skip the final check on your communications. A single bad send to the wrong contact can cost more than any time you saved.

Practical guardrails for everyday users

Start with a narrow test. Enable the feature on a non-primary Mac account. Keep approval prompts on. Do not turn on persistent approval. Limit the contact set you reference in prompts. Avoid pasting sensitive threads or private attachments into the assistant. Watch the macOS Privacy and Security panes so you know exactly what you granted. If the app asks for new categories, stop and reassess. Good tools respect a firm “no.” Good users say it often.

What still needs proof before you relax

Two answers would cool tempers fast. First, a public, third-party audit that shows what data leaves the device when you search and when you send. Second, a precise map of what Full Disk Access enables for this specific build. OpenAI’s retention policy for the Mac app matches the web version, which means your chats and files follow the same storage rules unless you change settings. Until independent tests confirm the network path and logs, assume standard retention applies.

Bottom line for Apple households

The value is clear: smarter search, faster replies, and less typing in long threads. The cost is the permission blast radius that comes with agent-style help on macOS. If you keep approval prompts on, use it with care, and revoke access when done, you can capture the upside while boxing in risk. If you cannot live with the worst-case send, do not grant the keys. That is not fear. That is basic digital hygiene—and it never goes out of style.