OpenAI shipped a plugin this week that lets ChatGPT on the Mac read, search and send messages through Apple’s Messages app, working across iMessage, SMS and RCS. Ask it what you missed yesterday, and it will summarize the thread. Ask it to reply, and it drafts the message and sends it through Messages on your behalf.
The plugin works through AppleScript and macOS Accessibility features, the same automation layer that has let third-party utilities control other apps for years. Apple built no special door for it. Setup requires walking through several permission screens: access to on-device Messages history, Full Disk Access in System Settings, and the names of a user’s contacts. OpenAI’s own plugin guide, alongside the release notes, states that sending is gated by a confirmation prompt by default, and separately discloses “a known issue involving tasks that disable approval prompts.” Users can also turn off confirmation entirely on a given conversation. The feature currently works only on Apple silicon Macs, and only for ChatGPT’s Work and Codex tiers.
Ari Weinstein, an OpenAI engineer, posted his own demonstration on X: “It’s really fun to get insights about who you talk to, and what you talk to people about.”
It also shipped six weeks into active litigation between the two companies. Apple sued OpenAI on July 10, accusing former employees of stealing trade secrets on the company’s behalf. The complaint centers on Tang Tan, an Apple product-design veteran who left in 2024 to join Jony Ive’s startup io, which OpenAI later bought for $6.5 billion to build its own hardware. Apple alleges Tan used an internal Apple project codename while interviewing job candidates, directed candidates still employed at Apple to bring physical components to “show and tell” style interviews, and that a former Apple systems engineer downloaded a compilation of confidential manufacturing files after leaving for OpenAI. OpenAI has called the suit meritless and moved to dismiss it on August 6, telling the court Apple’s complaint was “built on selectively excerpted communications and ordinary conduct stripped of context.” Neither company has said whether the Messages plugin was built with the other’s knowledge.
Apple has moved against unauthorized access to its messaging platform before. In 2024, it repeatedly disabled the Beeper Mini app’s connection to iMessage until the company gave up trying to restore it. Automation tools reaching third-party apps through Accessibility features sit in a different category from what Beeper built, closer to how a screen reader or a password manager works than to a reverse-engineered protocol client, which may be why Apple has not moved to block this one.
The plugin lands in the same season OpenAI shipped a purpose-built cyber model behind vetted access tiers rather than open release, and the same year researchers showed that a single email could plant a false memory in an assistant that had been granted persistent access to a user’s accounts.
Sources: 9to5Mac, Engadget, 9to5Mac on the Apple lawsuit
–
By the Control Plane Editorial Team