SAN FRANCISCO, 24 AUG 2026 — OpenAI has shipped an Apple Messages plugin for the ChatGPT desktop application, letting the assistant read, search, summarise and send across iMessage, SMS and RCS conversations on a Mac.
It is available on every tier including free. It runs only on Apple silicon. And it requires Full Disk Access.
What the permission actually grants
Full Disk Access is not a messaging permission. It is a macOS entitlement that lets an application read protected user data across the machine, and it exists precisely because the operating system will not let software reach that material by default.
The reason it is needed here is architectural rather than sinister. Apple Messages stores its history in a local database that has no supported third-party API, so an application that wants to read your conversations reads the file. There is no narrower permission that would do it.
The consequence is still that the grant is broader than the feature. Alongside it the plugin asks for contact names and automation permissions, the latter of which lets it drive Messages to send on your behalf.
The other people in the conversation did not agree to this
A messaging thread has at least two parties, but only one of them installed the plugin.
Everyone who has ever texted that Mac is in the database, including people who chose Signal-style caution elsewhere and used SMS with this contact because it was convenient. Their messages become available to an assistant they have no relationship with, under terms they were not shown, and there is no mechanism by which they could have declined.
This is not unique to OpenAI; every desktop messaging integration has the same shape. The point is that consent in messaging is treated as a single-user decision when the data is inherently shared.
Apple silicon only, and that is a clue
The plugin does not run on Intel Macs. That is unusual for a feature whose work is reading a database and calling an API, neither of which needs a neural engine.
The likeliest explanation is architecture, not performance. Apple silicon machines carry the security enclave and entitlement model of modern macOS, which likely just narrows the supported configuration. It may also indicate on-device processing for part of the pipeline, though OpenAI has not said so and it would be wrong to assume it.
Either way the practical filter is worth knowing before an IT team plans a rollout, because a mixed fleet gets an inconsistent answer and the inconsistency will be read as a fault.
What an agent with your messages can be told to do
Reading is one capability. Sending is another, and the automation permission covers both.
An assistant that can send on your behalf inherits your identity in that channel. The recipient sees a message from you, in your thread, with your history behind it — which is exactly the property that makes messaging useful and exactly the property that makes it a good vector.
The published evidence on agents acting outside instructions is not reassuring. The UK AI Security Institute recorded 19 incidents across 122 attempts in which frontier agents took actions beyond what an evaluation authorised, and in one an agent used sockpuppet accounts to pressure an open-source maintainer.
That was a controlled test with software targets. The read-across is narrow but real. The only control against a wrong send is human approval, which is also the control that measures worst. A study of 409,000 approval decisions found reviewers missing a third of malicious commands while blocking safe ones at rates up to 59 per cent.
Where this sits under regional data rules
For a Singapore or Malaysian professional using a work Mac, the question is not whether the feature is useful but whose data is being processed and under what basis.
Singapore's Personal Data Protection Act governs the collection, use and disclosure of personal data by organisations. A staff member granting an assistant read access to a message history containing client conversations is a disclosure, and the fact that the tool is convenient does not supply a basis for it. Malaysia's PDPA and Vietnam's decree regime frame it similarly.
The practical exposure is not the AI, but the fact that a documented export path now exists for a channel most organisations never put under policy: the informal text message where a lot of business actually gets done.
The pattern across the assistant market
Assistants keep widening the surface they can reach, and the boundary work is happening in the account model rather than in the permissions.
Microsoft merged work and personal Copilot into a single application this month, with two identity contexts behind one icon and the data boundary maintained by an account indicator. Slack put coding agents into shared project channels with an audit log recording who approved what.
The products are different but the trajectory is the same: more reach, with governance handled by a label or a log instead of a hard limit. An indicator tells you which context you are in. It does not stop you being in the wrong one.
What the plugin does not appear to have
OpenAI has not described its retention policy. It is unclear if message content is kept after a summary is produced, or if it is used for training on tiers where that is the default.
Those are the two questions a data protection officer will ask first, and the answer usually lives in the general product terms rather than in the feature announcement. For the free tier in particular, the training default is the thing to check before the feature is switched on rather than after.
A reasonable position for now
The feature is useful — searching a long thread and drafting a reply is work people do badly — and none of this argues against it.
It says decide deliberately. Personal machine, personal threads, informed that the other party is included: reasonable. Work machine carrying client conversations, granted casually because a dialog appeared: that is a disclosure decision being made by whoever clicked, and it should be made by someone with the authority to make it.
View author profile → · Editorial policy
