OpenAI's assistant has been handed a seat inside the most private app on the Mac. With Thursday's update to the ChatGPT desktop app for macOS, an optional Apple Messages plugin lets ChatGPT read and search a user's iMessage, SMS and RCS threads, summarize what it finds, draft replies, and send them through Apple's own Messages app — provided the user first unlocks the machine for it, permission by permission.
It is a small feature with a large implication. The debate about assistants living on your desktop has been mostly theoretical. As of August 20, 2026, a mainstream chatbot can be pointed at a decade of your text messages and told to act on them.
What the plugin actually does
OpenAI's own plugin documentation is unusually precise about the boundaries. "The Apple Messages plugin is available on all plans in the ChatGPT desktop app for macOS," the company writes. "In Codex and ChatGPT Work, it can read and search iMessage, SMS, and RCS chats on your Mac and send messages on your behalf through the Messages app. It doesn't let you interact with ChatGPT remotely through Messages, and it doesn't work in regular ChatGPT chats."
That last clause matters. Availability is universal across plan tiers — free users included — but the surface is not. The plugin only runs inside ChatGPT Work, OpenAI's business-facing app, and Codex, its software-writing environment. It does not appear in the ordinary consumer chat window, and it does not turn iMessage into a remote-control channel for the assistant. There is a hardware line, too: the feature ships only in the Apple silicon build, so Intel Macs are excluded.
Under the hood, OpenAI says the plugin runs locally on the Mac, leaning on the same macOS technologies — AppleScript and Accessibility — that power its Computer Use feature. Crucially, it does not build a persistent index of your conversations the way Apple's Siri AI does; it reads the message files on disk, when directed, and only with permission. OpenAI told Bloomberg the same.
Getting there means walking through several opt-in gates in both ChatGPT and macOS. Users must grant Full Disk Access in System Settings, plus permission for the app to read contact names and to drive other applications through automation. By default, ChatGPT sends nothing until the user approves both the message body and its recipients, with an "Allow once" choice per send — though approval can be waived per conversation, and OpenAI's plugin guide flags an edge case for anyone tempted to do that at scale: "If your task is set to Full access or otherwise disables approval prompts, Apple Messages may be unable to show the confirmation needed to send. Switch to Ask for approval or Approve for me and try again."
The company's enthusiasm was less hedged on X. "We've added native integration with iMessage, so ChatGPT can now send & read messages for you!" wrote OpenAI's Ari Weinstein. "It can also analyze your messages! It's really fun to get insights about who you talk to, and what you talk to people about."
Why It Matters
The Messages plugin marks a category shift building all year: the chatbot is becoming an operating-system agent. A model that answers questions in a text box has a bounded blast radius. A model with Full Disk Access, your contact graph and the authority to send messages under your identity does not. Every capability that makes the feature useful — reading the whole thread history, knowing who "Mom" is, hitting send without a human retyping the words — is the exact capability an attacker would want.
That is the prompt-injection problem, and messaging is close to a worst case for it. Text messages are unsolicited and arrive from strangers: pure untrusted input. An assistant asked to "catch up on my messages" has no reliable way to distinguish a friend's request from a hostile instruction embedded in a spam text written to be read by a machine. OpenAI has said as much in its own security writing. "Giving an agent a very broad instruction such as 'review my emails and take whatever action is needed' can make it easier for hidden malicious content to mislead the model, even though it is designed to check with you before taking sensitive actions," the company warns in its published guidance on prompt injections, where it also concedes the issue "remains a frontier, challenging research problem."
The approval prompt is the load-bearing defense, which is why the per-conversation opt-out is the detail worth watching. Confirmation dialogs erode under repetition; users who approve forty sends in a row start clicking through the forty-first. Inc.'s Kit Eaton framed the enterprise version bluntly: Macs are common business machines, and a plugin marketed with dinner-plans examples is trivially repurposed into client communications — with a company's contact list and message history in scope.
There is a competitive subplot too. Apple is suing OpenAI, alleging in its complaint that "at every level, from members of its Technical Staff to its Chief Hardware Officer, and in coordination with business partners, OpenAI has been stealing Apple's trade secrets and confidential information." Apple's revamped Siri competes directly with exactly this workflow. OpenAI has now built a Messages assistant on Apple's platform using Apple's automation frameworks, without Apple's blessing — and, notably, without needing it.
What to Watch
Three things. First, whether Apple responds technically: it has altered the iMessage stack before to shut out third parties, and Full Disk Access plus AppleScript is a route it controls. Second, whether researchers land a working injection against the plugin — the Black Hat demos against agentic browsers this month make the attempt inevitable, and messaging offers a far more intimate payload than a shopping cart. Third, whether the feature graduates out of Work and Codex into the consumer app. That restriction is doing quiet risk-management work right now. If it lifts, hundreds of millions of message archives become addressable by an agent, and the question stops being architectural and starts being actuarial.
“Giving an agent a very broad instruction such as 'review my emails and take whatever action is needed' can make it easier for hidden malicious content to mislead the model, even though it is designed to check with you before taking sensitive actions.”— OpenAI, Published guidance on prompt injections