ChatGPT Can Now Read and Send Your iMessages

On August 20, OpenAI released a plugin that lets ChatGPT read, draft, and send your iMessages. Not summarize them. Send them — to real people, who will think you wrote them.

Before you panic or dismiss it, both instincts are half right. The guardrails are more thoughtful than the headlines suggest. The permission it asks for is much larger than the thing it does. Here's the whole picture in plain English.

What it can actually do

• Read and search your messages. iMessage, SMS, and RCS — so it isn't limited to other Apple users.
• Draft replies. In your thread, in context, using your history.
• Actually send them. This is the part that's different. Most AI features read your data. This one takes an action another person receives.
• Summarize and pull information. Long threads, specific details, whole conversations.

Three limits worth knowing. It only runs on Apple Silicon Macs — Intel machines can't use it at all. It only works inside the ChatGPT desktop app, in the Work and Codex surfaces, not a regular ChatGPT chat. And it won't send anything without showing you the message and the recipient first.

That last one deserves credit. Approval is on by default, and OpenAI explicitly warns users not to switch it off. It also won't read your history unless you ask it to.

The permission almost nobody reads

Here's what gets skipped in every video about this: ChatGPT needs three macOS permissions before it can touch a single message. Two are narrow. One is not.

Contacts lets it match numbers to names. Automation lets it drive the Messages app. Both are scoped, both make sense, both are a one-click prompt.

Full Disk Access is the third one, and it isn't a Messages permission. It's a whole-machine permission. Apple protects the Messages database, so reading your texts requires it — but there's no version that says "just Messages." An app with Full Disk Access can read your documents, your mail, your photos, your backups. Everything on the drive.

That's why macOS won't let an app grant it from a pop-up. You have to walk into System Settings yourself, find it, and flip the switch. Apple built that friction on purpose.

How to check your own Mac

You don't have to take anyone's word for what's on your machine. Go look.

Open System Settings → Privacy & Security, then check these four panels for ChatGPT:

• Full Disk Access — reads the Messages database, and everything else on your drive
• Contacts — matches names to numbers
• Automation — controls the Messages app to send
• Accessibility — the plugin runs through AppleScript and Accessibility

If ChatGPT isn't listed in any of them, it has never been granted access to anything.

To take it back: toggle it off in each panel, then quit and reopen ChatGPT. Or remove the plugin from the Plugins page entirely.

One setting to leave alone: message approval. It's on by default, and OpenAI itself advises against enabling persistent auto-send for a chat.

While you're in there, look at who else is in that Full Disk Access list. Most people find three or four apps they granted years ago and forgot about — a backup tool, a cloud drive, something they installed once. Those have the same access ChatGPT is asking for.

One more thing

This isn't Apple Intelligence. OpenAI built this plugin itself, running on standard macOS mechanisms. Whether Apple was involved in developing it hasn't been confirmed either way.

What we do know is the timing. Apple sued OpenAI in July over trade secrets. OpenAI asked a judge to dismiss the case in early August. Two weeks later, OpenAI shipped a tool that reaches into Apple's most personal app.

I'm not turning it on. Not because the safeguards are bad — they're genuinely well built. Because the trade is that I'd type slightly fewer text messages, and in exchange one more application can read every file on the machine I run my business from. That math doesn't clear for me.

It might clear for you. Just do the arithmetic before you click, because that System Settings toggle is the last place anyone actually thinks about it.

This is the kind of thing we work through inside Leveraging AI: what these tools actually do, and what they actually cost you.

Come build with us.