ChatGPT can now touch your Messages inbox, and that should make people nervous

OpenAI has added an Apple Messages plug-in to ChatGPT, which means users can connect their Messages inbox and ask the chatbot to sort, summarize, search, draft, send, and even delete texts. It also works with Codex and ChatGPT Work, so this isn’t being pitched as a personal convenience feature. OpenAI wants it in the middle of everyday communication, including business use.

That’s a big step. It’s also a messy one.

Messaging is one of the last places where people still expect a bit of friction before something goes out under their name. ChatGPT’s new plug-in tries to remove that friction. It also shifts a lot of trust onto a system that already acts as a reasoning layer, a drafting layer, and now a message operator. That’s a lot to ask from a tool that still gets basic things wrong.

What the plug-in does

The pitch is straightforward: connect Apple Messages to ChatGPT and let the model work with your inbox.

OpenAI says users can:

• sort and analyze messages
• edit and draft replies
• search message history
• delete messages
• send texts on the user’s behalf

A demo video shows the chatbot suggesting follow-up messages based on texts received the previous day. That part makes sense. LLMs are good at turning messy informal language into a plausible reply. They’re also good at sounding confident while being slightly off. In a private inbox, that’s annoying. In a send-on-behalf-of workflow, it becomes a real risk.

The more interesting bit is the integration with Codex and ChatGPT Work. That points to OpenAI treating messaging as another data source in a broader agent workflow, not just a consumer feature. If your assistant can inspect messages, pull context, and then generate actions across personal and work settings, it starts looking less like a chatbot and more like a thin automation layer with natural language on top.

That’s useful. It also tends to grow faster than the guardrails.

The privacy story is doing a lot of work here

OpenAI told Bloomberg that the plug-in runs locally on a user’s machine and that it “doesn’t create an index of all someone’s messages.” That’s reassuring, but only up to a point.

“Runs locally” can mean several different things in practice:

• Messages stay on-device and are only read when the user asks
• a local helper process extracts limited context and forwards prompts to the model
• the system caches metadata or message snippets temporarily
• parts of the interaction are sent to OpenAI’s servers for inference or logging

Those are very different setups from a privacy perspective. If you’re a developer or security lead, you know the gap between “local” and “private” is where the real risk sits. Apple’s platform rules, sandboxing, entitlements, and permission prompts matter, but they don’t answer everything. What the plug-in can access, what it stores, and what gets transmitted are the details that matter.

The claim that it doesn’t build a full index is good news in one narrow sense. It suggests OpenAI isn’t flattening your entire message history into a remote searchable database. But if ChatGPT can still search, summarize, and retrieve old threads, some kind of local retrieval layer still has to exist. That may be safer than a cloud index, but it’s still a high-value target.

There’s also a behavioral risk here. Once people get used to asking an assistant to “find that thread from last Tuesday” or “draft a response to my landlord,” they stop thinking carefully about message boundaries. Product teams love that. Security teams don’t.

Sending messages is where it gets sharp

OpenAI says users should keep an eye on what ChatGPT is doing and avoid persistent approval, because turning that on “removes your final chance to review a message before ChatGPT sends it as you.”

That warning matters.

A system that drafts a reply is one thing. A system that sends the reply crosses into delegated authority. Once a model is allowed to transmit messages in your name, it becomes an action executor. That creates a handful of obvious failure modes:

• it sends the wrong message to the right person
• it sends the right message with the wrong tone
• it sends a message at the wrong time
• it sends a message using stale or incomplete context
• it auto-confirms a draft the user would have edited

The last one is the quiet failure. No drama, just a slightly too confident message that you technically approved but barely looked at.

Persistent approval is tempting because it removes clicks. That’s the point. But in messaging, one extra click isn’t a design flaw. It’s a circuit breaker.

For enterprise use, this matters even more. If ChatGPT Work can touch work messages, companies need to think about policy, logging, and authorization boundaries. Who can enable the plug-in? What gets recorded? Can admins revoke access? Are messages redacted before model processing? Can the assistant send messages without a second approval step? Those are the questions that decide whether this is a handy productivity feature or a compliance headache.

Apple Messages is a natural target, and a weird one

On paper, Apple Messages makes sense for this kind of integration. It’s deeply embedded in daily communication, especially in the U.S., and iMessage threads often contain the kind of lightweight context LLMs are good at organizing.

It’s also an awkward fit.

Messages is not email. It’s not a CRM. It’s not a task system. It’s a pile of personal, informal, sometimes sensitive exchanges with weak structure and lots of context dependence. That makes it a good demo target and a bad place to be sloppy.

A model can summarize a thread. It can infer a follow-up. It can even draft something that sounds like you. It can’t reliably know whether a joke in a family thread is actually welcome, whether a work message is urgent or just noise, or whether a deleted text was meant to stay around for records. That last one matters more than people admit.

Deletion raises its own questions. If ChatGPT can delete messages, users need to know whether that action is reversible, how it maps to Apple’s sync behavior, and whether deletions propagate across devices the way they expect. Messaging systems are full of edge cases. A local assistant sitting on top of them can make those edge cases uglier, not simpler.

For developers, this is a pattern, not just a product

The bigger story is the shape of the integration.

OpenAI is pushing toward systems that can act on first-party apps and data, not just generate text in isolation. That means the useful technical work is shifting from prompt craft to permissions, transport, local connectors, and safe action execution. Less “what should the model say?” and more “what is it allowed to read, infer, and send?”

That’s the part senior engineers should care about. The architecture behind this feature will probably look familiar:

• a local connector or agent shim
• permissioned access to a user’s Messages store
• retrieval over recent or relevant threads
• a model call for drafting or classification
• an approval gate before side effects
• optional automation for users who accept the risk

That pipeline is efficient. It’s also brittle. Every stage creates failure modes. Every stage needs auditability. And every stage gets harder to reason about once the model both interprets context and triggers actions.

The same pattern will show up in more apps. Mail, calendars, docs, ticketing systems, maybe even repo comments. Messaging is just the first place where the product risk is obvious enough to talk about.

The useful part, and the uncomfortable part

There’s a real productivity gain here for people who live in inboxes and text threads. Summarization, search, and drafting are genuinely useful. They save time in exactly the kind of low-value communication churn that eats a workday.

But the feature lands in a trust-sensitive zone. A chatbot that can read your messages is one thing. A chatbot that can send them as you is another. Once the send button is in play, the bar changes. Accuracy matters more. Permissioning matters more. Failure handling matters more.

OpenAI seems aware of that, at least enough to warn against persistent approval. Good. That warning should probably be louder.

The question now isn’t whether AI can help manage messages. It clearly can. The question is how much authority people are willing to hand over for the convenience of skipping a few taps. That answer will probably be different for a teenager, a freelancer, and a company with compliance obligations. It should be.