What Is ChatGPT's Apple Messages Plugin? August 2026
The Short Answer
Around August 20, 2026, OpenAI shipped an Apple Messages plugin for the ChatGPT macOS app. It lets ChatGPT read, search, summarise, draft and send messages across iMessage, SMS and RCS, once you grant permission.
| Property | Detail |
|---|---|
| Announced | ~August 20, 2026 |
| Platform | ChatGPT desktop app for macOS, Apple Silicon |
| Availability | Across ChatGPT plans, including ChatGPT Work and Codex |
| Message types | iMessage, SMS, RCS |
| Where it runs | Locally on the Mac |
| Server-side index | OpenAI states it does not index all messages on its servers |
| Send behaviour | Approval of content and recipients required by default |
| macOS permissions | Full Disk Access, contacts, automation |
Verified August 23, 2026.
What It Actually Does
Four capabilities, in ascending order of consequence:
Search. Find that address someone sent you in March without scrolling. This is the least controversial and probably the most used feature — Messages search has always been poor, and semantic search over your own thread history is genuinely useful.
Summarise. Catch up on a group thread that ran to 200 messages while you were away.
Draft. Compose a reply with context from the conversation.
Send. Deliver it.
The first three are read operations. The fourth crosses a line that matters, and OpenAI’s own guidance treats it that way.
The Permission Model
Enabling the plugin requires grants in two places: inside ChatGPT, and in macOS System Settings — including Full Disk Access, contacts access and automation permissions.
Full Disk Access deserves a pause. It is required because the Messages database lives in a protected location. But Full Disk Access is not scoped to Messages. It is a broad macOS permission covering protected user data across the system. Granting it to the ChatGPT app is a larger decision than “let ChatGPT read my texts,” and it is worth making deliberately rather than by clicking through a setup flow.
On explicit invocation. Per OpenAI’s description, ChatGPT will not pull in message context unless you prompt it to — the assistant does not silently read threads in the background. That is the right default, and it is the behaviour to verify if you enable this.
The Send Approval — and the Known Issue
By default, sending requires you to approve both the message content and the recipients. OpenAI explicitly advises against disabling that approval, since it is the last checkpoint before something irreversible.
More importantly, OpenAI has acknowledged a known issue where certain tasks can disable the approval prompt.
That acknowledgement is the single most useful piece of information in this release. An agent with send capability and a suppressed confirmation is the exact failure mode that produces embarrassing or damaging outcomes — a draft sent to the wrong thread, a half-finished reply delivered to a group. Until that issue is closed:
- Keep approval enabled and check it periodically.
- Read the recipient list, not just the message body. Recipient errors are the costly ones.
- Avoid using the send capability inside long autonomous task chains, which is the context where the prompt suppression has been reported.
The Prompt Injection Problem Nobody Should Skip
This is the risk that generalises beyond OpenAI.
Your Messages inbox contains text written by other people. When an assistant reads that text to summarise a thread, it is processing untrusted input. If someone sends you a message crafted to look like an instruction — and the assistant is also holding a capability to send messages and read your files — the ingredients for a genuine attack are assembled.
This is the same class of problem that produced the AI assistant vulnerabilities of mid-2026, where retrieval and disclosure capabilities were combined without a trust boundary between the content being read and the actions available.
Practical mitigations available to you today:
- Keep send approval on. It is the boundary. An injection that cannot act without your click is a nuisance, not a breach.
- Be specific about scope. “Summarise my thread with Kate from this week” is safer than “check my messages and handle anything urgent.”
- Do not chain it to other tools. The risk multiplies when an assistant can read untrusted messages and act in other systems in the same task.
- Treat requests inside messages as data. If a summary reports that someone asked you to send credentials or approve a transfer, verify through another channel — the same rule that has always applied to email.
Should You Enable It?
Reasonable yes: you live in Messages, you want search and catch-up summaries, you keep send approval on, and you understand what Full Disk Access grants.
Reasonable no: your Mac holds client confidential material, you work under a compliance regime with restrictions on third-party access to communications, or you would find it hard to explain to a security reviewer why the ChatGPT app has Full Disk Access.
For work machines specifically: this needs a policy decision before individual enablement, not after. If your organisation manages Macs with MDM, the relevant question is whether Full Disk Access grants to AI assistant apps are permitted at all. The answer should be written down before someone enables it on a laptop holding customer data.
What This Signals About Assistants in 2026
The wider pattern matters more than one plugin. Assistants are moving from “answer my question” to “operate my computer” — and OS-level personal data is the current frontier: messages, files, contacts, calendars.
The technical questions are largely solved. The unsolved questions are all about boundaries: what does the assistant read, what can it do without asking, and what happens when the content it reads is written by an adversary. OpenAI’s decision to require approval on send by default is the correct instinct. The acknowledged bug that can bypass it is the reminder that defaults are only as strong as their implementation.
Enable it if it is useful to you. Keep the confirmation step. Do not let it read and act in the same unattended breath.