OpenAI shipped a plugin for the ChatGPT desktop app on macOS that connects the assistant directly to Apple’s Messages app, letting it read, search, and prepare messages across iMessage, SMS, and RCS threads. The plugin is live on all ChatGPT plans and works inside ChatGPT Work and Codex.
The stakes are structural, not hypothetical. A full Messages archive is one of the most personal datasets on a Mac: years of conversations with family, coworkers, doctors, and exes, searchable in one place. Handing an AI system read access to that archive is a different category of integration than letting it browse the web or edit a document.
OpenAI’s own access model draws a clear line between reading and sending. The plugin can read and search chats without a confirmation step. Sending is gated: by default, ChatGPT shows the drafted message and its recipients and waits for approval before anything goes out. Users can turn off that confirmation on a per-conversation basis, which converts a one-time permission into a standing one for that thread.
That distinction between per-request and persistent approval is the part worth watching. OpenAI’s plugin documentation flags the risk directly, including a known issue in which certain automated tasks can disable the approval prompt. The company also publishes steps to revoke the plugin’s access entirely, which suggests the permission is meant to be reversible rather than a one-time grant baked into the account.
The feature does not turn Messages into a remote control channel for ChatGPT. According to OpenAI’s plugin guide, the integration does not let a user message ChatGPT through the Messages app itself, and it is unavailable in standard ChatGPT chats outside Codex and ChatGPT Work. For now it also requires an Apple silicon Mac; Intel machines are not supported.
9to5Mac, which first detailed the update on August 20, reported that the Messages plugin was the centerpiece of a broader desktop release. The same update syncs pinned chats between the Mac and iOS apps, and adds read-only sharing for Codex conversation threads. Personal-account share links are accessible to anyone holding the URL, while workspace links stay restricted to workspace members; OpenAI said Codex strips known secret patterns from shared threads but still asked users to review a snapshot before sending it out, since sensitive content can remain.
Separately, OpenAI is letting workspace members co-edit a ChatGPT-hosted Site once the owner has published it once, with the owner keeping control of access, settings, and version rollback. Some Site owners can also swap the site’s hosted URL without a redeploy, with the old address redirecting automatically. A Computer History feature that launched last week is expanding to Pro, Business, and Enterprise users in the EEA, Switzerland, and the UK; it requires Memories to be on and stays off by default.
None of this makes ChatGPT autonomous inside a user’s phone number. But it does put an AI system one settings toggle away from standing send access to a person’s private message history. Teams evaluating ChatGPT Work or Codex for staff Macs should treat the per-conversation approval bypass as a setting to audit, not assume, before rolling the plugin out broadly.
9to5Mac (Zac Hall), August 20, 2026.
