ChatGPT Apple Messages plugin: iMessage access comes with sweeping permissions

OpenAI launched an Apple Messages plugin for ChatGPT on Mac in August 2026, letting the chatbot read, search, summarize, draft, and send iMessages. For AI builders and teams, this convenience comes with a permission footprint that extends far beyond your texts. Enabling the plugin requires Full Disk Access, Contacts, and Automation permissions, which grant access to multiple protected Mac areas.

The permission cost you should understand

The ChatGPT Apple Messages plugin requires Full Disk Access, Contacts, and Automation permissions. Full Disk Access, per Apple's support documentation, exposes data across protected areas of a Mac, not just the Messages folder. OpenAI states the plugin runs locally and doesn't build a full message index. But local processing doesn't shrink the permission footprint. Granting Full Disk Access means giving ChatGPT the ability to read files outside your message threads, which has been compared to handing a master key to a houseguest.

Why this matters for teams and builders

For anyone using Messages for client communication or internal coordination, enabling this plugin without IT sign-off could expose client names, meeting logistics, or sensitive threads. The feature may save time drafting replies or summarizing conversations, but the trade-off in system access is significant. Prior incidents add caution: OpenAI's Mac app previously stored chat histories in plain text before issuing a patch. Apple has also faced data-exposure issues with iCloud. While the plugin runs locally, the permission breadth means you're trusting the local process to handle all that data correctly.

Practical implications for deployment

If you manage Macs in a development team or corporate environment, treat the ChatGPT Apple Messages plugin as a system-level change that requires policy review. For individual developers on personal machines, the risk is personal. But for any machine handling client work or sensitive project data, the plugin should be evaluated under existing IT security policies. There is no evidence that message data is sent to OpenAI servers for this feature, but the local access is broad enough to matter. Test in a sandbox before rolling out.

Caveats and unknowns

Most reporting on this feature comes from tech outlets and Bloomberg, with no independent testing of the plugin's data handling provided in the available sources. OpenAI's local processing claim is based on company statements, not independent audit. The exact scope of macOS areas accessible via Full Disk Access when used by this plugin is not fully detailed in the evidence. Builders should verify behavior in a controlled environment.