An AI assistant on the Mac can now read and search private Apple chat history and fire off messages on a user’s behalf after a single permission grant. The capability widens the attack surface researchers have been flagging all summer: assistants with deep system access are becoming prime targets for infostealers and prompt-injection tricks.
OpenAI switched on the Apple Messages plugin for the Mac edition of ChatGPT this week, spanning every subscription tier, and both the ChatGPT Work workspace and the Codex coding companion can drive it. The plugin reaches into iMessage, SMS, and RCS threads stored on the machine, and Apple silicon is required, so Intel Macs miss out. It executes on the Mac itself rather than in the cloud, hooking into the same macOS machinery OpenAI’s Computer Use tool relies on, notably AppleScript and Accessibility.
Out of the box, nothing goes out without the user confirming both the message and its recipients. OpenAI’s own notes flag a configuration trap: tasks set to Full access, or anything that turns off approval prompts, can stop the send-confirmation dialog from ever appearing, leaving the guardrail silently gone. Persistent approval stays available with documented revocation steps, and the plugin only touches message files stored locally. Unlike Siri AI, it keeps no searchable index of chat content, using the data only when directed.
The rollout follows OpenAI’s Computer History feature, which began logging Mac activity into plain-text files days earlier and drew warnings that infostealers could read the records. Chat transcripts are a richer prize for credential thieves, and iMessage stays end-to-end encrypted, so an assistant with read and send rights becomes the weak link in that chain.
