ChatGPT Grabs Messages—What Else?

One click gives ChatGPT the keys to your Mac’s Messages—and maybe far more than you realize.

Story Snapshot

ChatGPT on Mac can read, search, draft, and send texts in Apple Messages with your permission.
Enabling it may require Full Disk Access, contacts, Accessibility, and automation permissions.
OpenAI says the feature relies on macOS Accessibility and can be turned off there.
By default you approve each send, but a persistent mode can skip final checks, per reports.

What exactly ChatGPT can do inside Apple Messages

OpenAI’s Mac app now plugs into Apple Messages on your computer. With your approval, it can read and search your iMessage, text, and rich communication chats, draft replies, and send them from the Messages app on your behalf. The feature lives in the desktop app’s Work and Codex modes, not regular chats, which hints at a focused, task-first design rather than casual use. This is powerful help for overloaded inboxes. It is also a wide-open gate if you do not set firm limits.

OpenAI and press reports say you must allow several macOS permissions to make this work. Users are asked to grant Full Disk Access, expose contact names, and allow both Accessibility and automation control. Each permission is opt-in, but the combined scope is large for a messaging helper. Apple’s own security guide explains Full Disk Access lets an app reach all files, including Mail, Messages, Safari data, and even backups, which raises the stakes for any assistant with that power.

How it works under the hood—and how to shut it off

OpenAI’s documentation says the integration uses the macOS Accessibility application programming interface to read on-screen content and interact with apps. You can disable the feature by revoking Accessibility permission in your Mac’s settings. That single switch cuts the assistant’s eyes and hands across apps, including Messages. This design keeps control close to the user. It also means a careless click can grant very broad reach in one step.

OpenAI says the macOS app follows the same data retention rules as its website experience. Conversations, screenshots, and files you share through the app follow that policy, which can include limited retention windows and settings you control. There is no special carve-out here just because the data came from a Mac integration. That clarity helps, but it does not answer what a bad actor could do if you grant the wrong permissions on your machine.

The send button problem: approvals and the “persistent” trap

By default, message sending requires your review. The app shows the recipient and the drafted text, and nothing goes out until you approve it. Reports add that you can enable a persistent approval mode that skips that final check, which speeds work but raises obvious risk. If you remove the last human glance, you trust a tool with both your words and your relationships at once. For anyone with business, legal, or family stakes, that trade is not small.

ChatGPT plugin for Apple Messages: Imagine using Signal for a private conversation specifically because you don’t want anyone outside that conversation to read it.

Think Signal when considering the privacy implications, not SMS or email.

Apple Messages supports 3 services:

1.…

— Paul Walsh (@Paul__Walsh) August 23, 2026

Apple’s support material for using ChatGPT within Apple Intelligence stresses choice. You pick what content to send to ChatGPT, and you can keep requests local or opt in to share when needed. That lines up with core conservative values on consent and personal responsibility. Tools should ask, you should choose, and the system should make it easy to pull the plug. The tension comes when one switch, like Full Disk Access, reaches far beyond the task you had in mind.

Practical risk math for everyday users

No public record here shows a confirmed breach tied to this feature. The current risk is about blast radius, not proven misuse. If you grant Full Disk Access, Accessibility, and automation, you give a single app broad reach across your Mac. That is fine if you understand it and lock it down. It is reckless if you do not. Start with the narrowest permissions that let you get your task done. Keep default per-message approval on. Review what you shared. Revoke when finished.

What to do before you click “Allow”

Decide what you want ChatGPT to do, and match permissions to that task only. Keep per-send approval on for any account tied to work, clients, or sensitive contacts. Decline persistent approval unless you are ready to own the fallout of an unvetted send. Check Apple’s Privacy and Security settings monthly. If you see Full Disk Access granted and you do not need it, remove it. If a feature seems too broad for your comfort, turn off Accessibility for the app and walk away.