Here is the tension most people will miss: the same company selling you on how "fun" it is to get insights about who you talk to is the company telling you, in writing, not to trust the feature that makes those insights possible.
On August 20, OpenAI's Ari Weinstein pitched the new Apple Messages plugin for ChatGPT on Mac like a party trick. "It can also analyze your messages!" he wrote. "It's really fun to get insights about who you talk to, and what you talk to people about."
Now name the people in that fun.
The friend who texted you a password because it was faster than a password manager. The partner who vented about their boss on a Tuesday night. The sibling who sent an address, a bank detail, an OTP. None of them installed anything. None of them clicked a permission dialog. None of them has any idea an AI company can now read what they sent you.
That is the actual privacy story here, and it is not the one in the demo video.
Last week, this brief covered OpenAI's Mac-recorder push — Computer History, the feature that watches your screen activity for context. This week the same desktop-agent strategy reaches past what you're doing and into what everyone has ever said to you. The plugin reads and searches iMessage, SMS, and RCS, drafts replies, and sends them through the Messages app. It runs on all plans, Apple Silicon only, inside ChatGPT Work and Codex.
The convenience is real. Ask it to find a birthday buried in a thread and add it to your calendar. Ask it to clean up spam. Ask it to check your calendar and reply with times you're free for dinner. For anyone drowning in message history, that's genuinely useful.
But the consent math is broken by design. When you grant ChatGPT access to Messages, every person you've ever texted is indirectly opted in. The permission dialog is yours. The data is everyone's.
Here's where OpenAI's own documentation becomes the tell.
By default, sending a message requires your approval every time — an "Allow once" choice per send, where you review the content and the recipients before anything goes out. You can instead flip "Always allow sending to this chat," which lets ChatGPT fire off future messages to that thread without asking.
OpenAI actively discourages that setting. Its plugin guide reads: "Keep per-send approval for chats that may contain untrusted or misleading instructions. Persistent approval removes your final chance to review a message before ChatGPT sends it as you."
Read that twice. OpenAI is describing your text threads as "untrusted or misleading instructions."
OpenAI is describing your text threads as 'untrusted or misleading instructions.' The company built a guardrail and then wrote documentation begging you not to remove it.
That's prompt-injection hygiene stated in plain language. A message thread is untrusted input. A chatbot with standing authority to send as you is a channel an attacker can steer — someone texts your Mac the right sequence of words, and a model with "Always allow" flipped on acts on them, as you, without a review screen in the way.
The company built a guardrail and then wrote documentation begging you not to remove it. That is not confidence. That is a vendor telling you it does not fully trust its own feature — and hoping you'll keep the one setting that protects you from it.
So the persistent-approval toggle isn't a convenience option. It's the load-bearing wall. Leave it standing.
The second decision point is quieter and, arguably, bigger. Setup requires enabling Full Disk Access in System Settings, plus granting ChatGPT permission to read your contact names.
Full Disk Access is not a modest permission. It's the macOS grant that lets an app reach the parts of your machine the system normally walls off. You are handing it to the desktop client of an AI company to make a texting assistant work.
OpenAI reportedly told Bloomberg, per iTechPost, that the plugin runs locally and "does not create an index of all of someone's messages." That sounds reassuring. But the company hasn't explained what that distinction means in practice — local to what, retained for how long, and what "index" excludes. Until it does, treat the phrase as marketing, not a guarantee.
There's one useful counter-signal on OpenAI's data posture this same window. On August 19, the company previewed Private Safety Processing, a system meant to detect abuse patterns across sessions without giving its own employees access to the underlying prompts or responses, and while preserving Zero Data Retention for eligible customers. It's aimed at enterprise and API users, not individual ChatGPT subscribers, and the technical white paper isn't out until September.
So the posture cuts both ways. OpenAI is capable of building genuinely privacy-preserving infrastructure when the customer is a business with leverage. The Messages plugin, aimed at everyone, ships with a "please don't disable this" warning instead.
Now the part Apple can't love. Apple has spent years turning privacy into a product — Siri asking permission before sharing files with ChatGPT, the ChatGPT extension staying off until you turn it on, the whole on-device gospel.
This plugin routes around all of it. It operates through the standalone ChatGPT desktop app, not through Siri's built-in extension. Its permission and approval flow is OpenAI's, working independently of Apple's own safeguards. A third-party AI company now operates inside iMessage — outside Apple's consent framework, on the platform whose entire brand is that this doesn't happen.
The buyer verdict, then, splits cleanly into two features wearing one name.
Read-and-search, on-device, is defensible. If you want an assistant to surface a detail from a three-week-old thread or summarize a group chat you've ignored since Tuesday, and you keep per-send approval on, you're getting real convenience for a contained risk.
The send side is where you should slow down. Never grant persistent approval. The moment you flip "Always allow," you've handed a chatbot standing authority to text as you — and OpenAI's own documentation tells you exactly why that's a bad trade.
And treat Full Disk Access as the real decision, not a setup step to click through. That grant is the price of admission, and it's steeper than the feature looks. If you wouldn't hand an unfamiliar app the keys to your whole drive, don't hand them over here just because the app is famous.
The insights are fun, sure. Just remember whose data makes them fun, and that not one of those people was ever asked.