OpenAI ships a Messages plugin that summarises who you talk to and what about

The ChatGPT desktop app can now read your iMessage history and send messages on your behalf. OpenAI shipped the integration this week for Macs running Apple silicon, and Apple, a company it is reportedly preparing to sue, was not part of the announcement.

The plugin reads and searches Messages conversations on the machine, covering iMessage, SMS, and RCS, and can draft and send replies. It will also analyse the archive, summarising who you talk to and what you talk about, which is a different capability from writing a text and a considerably more revealing one.

Sending is gated by default. Each outgoing message requires explicit approval, and OpenAI has been clear that this is the setting it expects people to keep.

Yet, users can turn that off. Granting persistent approval lets the model send without asking, and OpenAI’s own guidance advises taking care before doing so, which is an unusual thing for a company to say about a feature it built.

There is also a known defect. OpenAI acknowledges that certain tasks can disable the approval prompt, meaning the safety mechanism has a failure mode the company has documented rather than fixed.

The integration is available across all plans in the desktop app, with fuller behaviour in ChatGPT Work and in Codex. It does not run on Intel Macs.

None of this required Apple’s cooperation, which is the part worth sitting with. The Messages database lives on the local disk, and an application with the right macOS permissions can read it, so OpenAI has built on an access route Apple grants rather than one it negotiated.

Apple has spent a decade marketing Messages on end-to-end encryption. That encryption protects messages in transit and at rest on the device; it does not protect them from software the user has authorised to read the decrypted database, which is a distinction most people have never had reason to think about.

The relationship between the two companies makes the timing sharper. The Siri partnership has come apart over the past year, and this is a feature that routes around Siri entirely on Apple’s own hardware.

It also fits a pattern in what OpenAI has been shipping. The company recently added a feature that logs keystrokes and stores them in plain text, and has been pitching users on connecting their bank accounts, each of which trades a category of private data for convenience.

The privacy question here is not really about the user. It is about everyone in the conversation, none of whom agreed to have their messages summarised, and none of whom will be told.

Group chats make that concrete. A single participant enabling the plugin exposes the whole thread, including the parts written by people who chose Messages precisely because they thought it was the private option.

The enterprise version raises a separate question. ChatGPT Work users on managed Macs may have message archives that mix personal and professional correspondence, and OpenAI has not published guidance on how administrators should treat that.

Nor is it clear what leaves the machine. Reading the database happens locally, but the analysis that produces a summary of your contacts is model work, and OpenAI has not spelled out in the release notes which parts of a conversation are sent for processing and which are not.

That is the disclosure people will want and the one currently missing. A feature that reads private correspondence should say plainly where the correspondence goes.

Apple has not commented on the integration and has no obvious mechanism to block it short of changing how macOS grants access to the Messages database, which would break a good deal of legitimate software alongside it.

The company that built the encryption is not the one deciding who reads the decrypted text. That decision now sits with whoever clicks approve.