OpenAI shipped something on August 20 that sounds minor and is not. The ChatGPT desktop app on Mac can now open your Apple Messages, read the threads, search them, draft a reply and send it. Not in a sandbox. Not in a preview pane. In the real Messages app, to the real people in your contacts, from your number.
Then, in its own documentation for the feature, OpenAI told users to leave one setting alone. That warning is the most revealing part of the whole launch, and it is worth understanding before you flip anything on.
The short version
- What launched: an Apple Messages plugin inside the ChatGPT desktop app for macOS, on August 20
- Who gets it: all plans, but only in the Apple silicon build of the desktop app, surfaced through ChatGPT Work and Codex
- What it can do: read, search, summarize, draft and send iMessage, SMS and RCS
- What it needs: Full Disk Access, contact name access and automation permissions
- The setting to avoid: “Always allow sending to this chat,” which removes your last review before a message goes out
What the plugin actually does
Until now, the argument for Apple’s own assistant over ChatGPT came down to one thing: access. Siri lives inside the operating system. It can reach into Messages, Calendar and Contacts because Apple built it that way. ChatGPT could write you a very good reply, but you still had to copy it, switch apps and paste it in yourself.
The Messages plugin closes that gap on the Mac. Once enabled, ChatGPT can pull the contents of your conversations into its context, answer questions about them, and then push a message back out through Messages. Ask it who you owe a reply to, what your group chat decided about Saturday, or to draft something polite to the contractor who has gone quiet, and it can do all three in one pass.
There are limits worth knowing. It runs on the desktop app only, so there is no iPhone version. It ships in the Apple silicon build, which leaves Intel Macs out. And it does not work the other way around: you cannot text ChatGPT and get an answer back in Messages. This is ChatGPT reaching into your Mac, not a chatbot with a phone number.
| Capability | Status |
|---|---|
| Read and search your Messages history | Yes, once Full Disk Access is granted |
| Summarize a thread or a person | Yes |
| Draft and send iMessage, SMS, RCS | Yes, with send approval by default |
| Run on iPhone or iPad | No, macOS desktop app only |
| Run on an Intel Mac | No, Apple silicon build only |
| Text ChatGPT from your phone and get a reply | No, this is not a messaging bot |
The setting OpenAI told you not to turn on
By default, nothing leaves your Mac without you seeing it first. ChatGPT composes the message, shows you the text and the recipients, and waits. You pick “Allow once” and it goes.
Underneath that button is a second option: “Always allow sending to this chat.” Choose it, and every future message to that thread goes out without another look from you.
OpenAI’s own words
“Keep per-send approval for chats that may contain untrusted or misleading instructions. Persistent approval removes your final chance to review a message before ChatGPT sends it as you. Use it only when you accept that risk.”
Read that carefully. OpenAI is not warning you about typos. It is warning you that the model reads your messages, that messages can contain instructions, and that a model reading instructions tends to follow them.
Why this is a prompt injection problem, not a convenience problem
Every AI agent that reads content it did not write has the same structural weakness. The model cannot reliably tell the difference between “here is data for you to look at” and “here is a command for you to obey.” Both arrive as text. Both land in the same context window.
Your Messages app is full of text you did not write. Group chats. Forwarded screenshots with text in them. Two factor codes. Delivery notifications. Spam. Any of it can carry a line crafted to be read by an assistant rather than a human.
Per-send approval is the whole defense. It is a human being looking at the outgoing text one last time and deciding whether it makes sense. Turn it off for a thread and you have removed the only check in the chain, in exactly the place where the attack lands.
This is not theoretical hand wringing. Agentic AI has been the busiest part of the security calendar all year, and the pattern is consistent: the moment a model gets permission to act on the world, the content it reads becomes an attack surface. We saw a version of this play out when OpenAI’s own math-solving model got flagged as a cyber risk by its own evaluators. Capability and risk arrive on the same day, from the same feature.
The permissions this asks for are not small either
To make the plugin work, ChatGPT needs Full Disk Access in System Settings. That is macOS’s broadest permission tier, and the reason it is required tells you something: Apple stores your Messages history in a local database, and reading it means reading files the system considers protected.
You are also granting access to contact names and automation control. None of that is unusual for an app that automates Messages, and all of it is more than most people hand to a chat window.
Worth thinking about before you enable it
Full Disk Access is not scoped to Messages. It is a system-wide grant. If you are the sort of person who keeps client work, medical records or legal documents on the same machine, that is the context you are agreeing to open up, not just your group chats.
How to turn persistent approval back off
If you already tapped “Always allow” on a thread without thinking about it, this takes about fifteen seconds to undo.
- Open the ChatGPT desktop app on your Mac and go to Settings at the top
- Choose Computer use, then click Manage next to Messages
- Under Always allowed to send, click the trash icon beside any chat listed there
- Confirm with Remove
From that point on, ChatGPT asks before every send again. It is a two second tap on your side and it is the difference between an assistant that drafts and an assistant that acts unsupervised.
The bigger pattern here
OpenAI has spent 2026 pushing ChatGPT out of the chat box and into the places where your actual life happens. A dedicated product for teenagers, agents that browse and buy, coding tools that touch your filesystem. When the company launched a teen-specific version of ChatGPT this week, the criticism was about guardrails that did not hold on day one. The Messages plugin is the same story told through permissions: the product is genuinely useful, and the safety of it depends on a default that a single click can remove.
Apple, meanwhile, is building the same capability natively and has the platform advantage to do it more safely, which is part of why the company has been so slow and so quiet about it. Apple’s recent moves suggest it knows exactly how sensitive this surface is, from putting warnings directly on the lock screen to the camera-equipped AirPods it accidentally revealed in a macOS build. Every one of those features runs into the same question OpenAI just answered with a warning label: how much should software be allowed to do without asking?
What to watch next
- The first real injection demo. Security researchers have been pulling apart agentic features within days of launch all year. Expect a proof of concept against this one soon.
- Whether persistent approval survives. If a public incident lands, this is the setting that gets removed or heavily restricted first.
- Apple’s response. A third party reading the Messages database at scale is exactly the scenario Apple’s privacy marketing exists to prevent. Watch for tighter permission prompts in the next macOS update.
- Windows and mobile. The plugin is Mac only today. The moment this pattern reaches phones, the risk profile changes completely.
For now the practical advice is boring and correct. Use the plugin if it saves you time. Leave per-send approval on. And if you have already turned it off somewhere, go take it back.
