OpenAI has added an Apple Messages plugin to ChatGPT that can read, search and summarize iMessage, SMS and RCS conversations on Macs, prompting privacy concerns over access to messages involving people who have not enabled the feature.
- OpenAI launches an Apple Messages plugin on macOS allowing ChatGPT to read, search, and send iMessage conversations directly.
- The plugin requires Full Disk Access on Apple Silicon Macs, granting system-level file permissions across the entire operating system.
- Security researchers warn that non-users face unconsented third-party data exposure when their contacts enable this local desktop tool.
The plugin, released on Aug. 20, is available in ChatGPT Work and Codex on Macs using Apple Silicon. It requires users to grant ChatGPT Full Disk Access, Contacts access and Automation permissions.
By default, ChatGPT requires the user to approve the message and recipients before sending. OpenAI also provides a setting that allows messages to be sent to a particular chat without another approval.
Privacy researcher Paul Walsh described the feature as akin to “installing spyware,” while developer Steve Moraco called it a “total architecture abandonment and user trust betrayal” by Apple.
The descriptions are critics’ characterizations. The plugin is optional and requires users to grant permissions before it can access Messages.
Have a development worth tracking?
Share product launches, funding announcements, partnerships, research findings and market developments with The Grey Terminal's readership.
→ Submit a Press ReleaseMessages From People Who Never Opted In
The plugin can access message history stored on the Mac, including conversations with people who have not installed ChatGPT or agreed to give the service access to their messages. Neither Apple nor OpenAI notifies other participants in a conversation when a Mac owner enables the plugin, according to the product’s current design.
Forbes compared the issue with the concept of “shadow profiles,” referring to records of people who did not directly sign up for a service but whose information entered the service through another user. The comparison echoes concerns that have previously surrounded the use of contact lists by social media companies.
The plugin’s access is also not limited to a Messages-specific permission.
Full Disk Access Covers More Than Messages
Apple’s macOS security system requires Full Disk Access for the plugin to access protected files on the computer. It was reported that the permission allows the application to read and write files that are otherwise restricted.
Apple’s permission framework does not provide a separate Full Disk Access setting limited only to the Messages database. The requirement has drawn scrutiny because the permission can cover protected information elsewhere on a Mac.
OpenAI says the plugin does not create a complete index of a user’s messages. The company claimed that it runs locally and retrieves message content when a user specifically asks ChatGPT to access it.
OpenAI Says Messages Are Not Stored on Its Servers
OpenAI has also said that message content is not saved to its servers unless a user saves the ChatGPT conversation to the cloud. That statement addresses storage but does not establish that message content never reaches a cloud model during an AI request.
For example, a user asking ChatGPT to summarize a conversation would require the relevant content to be processed to produce the response. OpenAI has not said that the Messages plugin creates a permanent copy of the user’s entire message history on its servers.
ChatGPT Can Send Messages Too
The plugin gives ChatGPT access to actions inside Apple’s Messages application, including drafting and sending messages. OpenAI’s default configuration requires users to approve outgoing messages and recipients. The company recommends keeping that confirmation step enabled.
Users can instead allow ChatGPT to send messages to a particular conversation without requesting approval each time. That means the feature can move beyond analyzing existing conversations to communicating with other people on the user’s behalf.
The recipient is not given a separate indication that ChatGPT prepared or sent the message.
The Feature Does Not Break iMessage Encryption
The plugin does not bypass or break iMessage’s end-to-end encryption. Messages are decrypted at authorized endpoints, including devices where a user’s message history is available. Software with sufficient access to the device can potentially interact with that local data.
The privacy question therefore concerns access to the endpoint rather than the security of the encryption used to transmit messages. The feature currently works only on Apple Silicon Macs and is not available on iPhones.
The rollout also comes as Apple and OpenAI are engaged in a separate legal dispute. Apple sued OpenAI in July over alleged misappropriation of confidential hardware information. The case concerns trade secrets and is unrelated to the Messages plugin.
The Messages integration puts another issue in focus: how much access an AI assistant should receive to communications stored on a user’s device, and what protections should apply to other people whose messages are contained in those conversations.
Activate Terminal Layer
Structural analysis of the systems, pressures, and stakeholders behind this story.
