ChatGPT Can Now Read and Send Apple Messages on Mac

OpenAI’s new Apple Messages plugin gives ChatGPT access to conversations in Apple’s Messages app on a Mac. It can search and read chats, summarize conversations, prepare replies, and send messages through Messages after the required permissions are granted. The feature is available across ChatGPT plans, but it currently requires an Apple-silicon Mac and works through ChatGPT Work or Codex rather than a standard Chat conversation.

That makes the plugin more than a writing assistant: it can use personal software and take an external action on a user’s behalf. The practical benefit is less copying, searching, and switching between apps. The risk is that a mistake, a manipulated message, or an overly broad permission can affect private conversations—or cause ChatGPT to communicate as the user.

What the Apple Messages plugin can do

The plugin works with the three conversation formats handled by Apple’s Messages app:

• iMessage
• SMS
• RCS

Within those conversations, ChatGPT can find and read chats, summarize or analyze message history, prepare a reply, and send a message through Messages.

It is not a way to text ChatGPT remotely through iMessage. The plugin operates from the ChatGPT desktop app on the Mac and uses Apple Messages as the messaging application.

Availability, Mac compatibility, and plans

OpenAI’s documentation says the plugin is available on all ChatGPT plans in the ChatGPT desktop app for macOS. It is available in ChatGPT Work and Codex, not in regular ChatGPT chats.

The important hardware distinction is that the Messages integration currently supports Apple-silicon Macs. The broader ChatGPT macOS app supports macOS 14 or later on either Apple Silicon or Intel processors, but that does not mean an Intel Mac can use this particular plugin.

The desktop app now brings Chat, Work, and Codex together. OpenAI describes Work as an environment for longer, multi-step tasks, while Codex is focused on software development and technical work. The Messages plugin extends those agent-style workflows into a personal communication app.

How sending approvals work

By default, ChatGPT must ask the user to approve both the proposed message and its intended recipients before sending. That approval step is the key protection against an incorrect draft, a wrong contact, or a message sent without the user’s awareness.

OpenAI warns users to be careful with persistent approval settings. A persistent approval can remove the final opportunity to review an individual message before ChatGPT sends it as the user.

That distinction matters because reading and sending have different consequences. A summary can be wrong or incomplete; a sent message can create immediate social, professional, financial, or reputational consequences. For that reason, per-send approval should remain enabled for ordinary use—especially when messages involve unfamiliar recipients or sensitive topics.

Privacy: “local” does not automatically mean private

OpenAI has described the plugin as running locally on the user’s machine and said it does not create an index of all the user’s messages. However, the available reporting does not fully establish that every message remains only on the Mac or is never processed or retained by OpenAI.

The safest interpretation is narrower: the plugin uses the Mac and its local Messages access to find relevant conversations, but ChatGPT still needs the selected conversation content—or information derived from it—to analyze, summarize, or draft a response. The available documentation is not enough to support a stronger “everything stays local” privacy claim.

This also affects people who never agreed to use the plugin. Messages may contain other people’s personal information, private group discussions, authentication codes, work details, or legal and medical information. Broad access can therefore expose third-party data as well as the account holder’s own messages. Coverage of the launch raised those Apple and privacy concerns.

The main security risks

Prompt injection in message content

A message is untrusted input. If an agent reads a conversation, malicious text inside that conversation could attempt to influence what the agent does next. This is a form of prompt-injection risk: content that looks like an instruction may be treated as one even though it came from another person.

Overbroad access

A request about one conversation can become more invasive if the plugin receives access to a wider set of Messages data than necessary. The more chats an agent can inspect, the greater the chance that unrelated private information appears in a summary or workflow.

Wrong recipient or misleading draft

ChatGPT may produce a plausible but inaccurate reply, misunderstand the context, or select the wrong recipient. Those risks are particularly serious when a message involves money, credentials, confidential work, health information, or a relationship dispute.

Persistent permissions

Security research on agent skills identifies persistent, undifferentiated permissions as a significant risk because one approval can continue across later sessions and cover many different actions. In a messaging integration, that can turn a one-time confirmation into standing authority to communicate as the user.

Codex’s broader security model includes sandboxing and approval policies, with network access turned off by default in its documented agent environment. Those controls are useful, but they do not replace a human review of a message that will leave the device and reach another person.

What the plugin says about OpenAI’s agent strategy

The Apple Messages integration is part of a wider shift in the ChatGPT desktop app. OpenAI is combining Chat, Work, and Codex while adding connections to apps, files, screens, and other software.

The direction is clear: ChatGPT is moving from generating an answer in isolation toward gathering context, carrying out multi-step work, and taking actions inside the tools people already use. Messaging is a particularly visible example because the result is not just a private recommendation—it can become an external communication in the user’s name.

That creates a straightforward trade-off. Each integration can eliminate manual searching, copying, and clicking. Each one also increases the amount of personal context exposed to an AI system and raises the cost of an error or manipulated instruction.

A safer way to use it

For lower-risk tasks, such as finding an old conversation or creating a draft, the plugin may be convenient. For anything sensitive, use a conservative setup:

1. Grant the narrowest practical Messages access.
2. Keep approval required for every send.
3. Check the recipient, message text, attachments, and conversation context before approving.
4. Avoid using the integration for passwords, authentication codes, regulated information, or high-stakes legal, medical, or financial communication.
5. Treat instructions found inside messages as untrusted content, not as commands for the agent.

The plugin’s headline capability is impressive: ChatGPT can now work directly with iMessage, SMS, and RCS conversations on supported Macs. But the feature is safest when it remains an assistant that proposes actions—not an unattended system with standing permission to speak for you.