ChatGPT Can Now Read Your iMessages. What Happens To Your Data?

August 22, 2026

ChatGPT can now search and send Apple Messages on a Mac. Learn what OpenAI confirms, what remains unclear, and how to limit privacy risk.

Yes—ChatGPT can now read and search iMessage, SMS, and RCS conversations on a Mac, and it can prepare or send replies through Apple's Messages app. The new Apple Messages plugin is available in ChatGPT Work and Codex for eligible Business, Enterprise, and Edu workspaces on Apple-silicon Macs.

That does not mean OpenAI has announced a breach, copied every user's message history, or silently enabled the feature for every ChatGPT account. It means a user or organization can grant an AI assistant a new route into one of the most sensitive archives on a computer. The privacy question is therefore not simply “Does ChatGPT use my iMessages for training?” It is also: what can the plugin search, what enters a Work or Codex task, what can be sent, what is retained in the resulting conversation, and which controls are actually enforced?

OpenAI has documented the headline capabilities, business-training policy, and several workspace controls. It has not yet published a Messages-specific data-flow diagram or answered every scope, retention, attachment, deletion, and macOS-permission question. Until those details are available, the prudent approach is to enable the smallest useful capability for the smallest pilot group—and keep send confirmation on.

What Is Confirmed

OpenAI announced the Apple Messages plugin in its August 20, 2026 ChatGPT Business release notes and ChatGPT Enterprise and Edu release notes.

The official notes confirm that:

the plugin runs through the ChatGPT desktop app on Apple-silicon Macs;
it is available from Codex and ChatGPT Work for eligible Business, Enterprise, and Edu workspaces;
it can read and search iMessage, SMS, and RCS conversations;
it can prepare messages and send them through Apple's Messages app;
by default, ChatGPT asks the user to approve the message and recipients before sending; and
workspace administrators can disable Apple Messages through the existing Computer Use control.

OpenAI's broader plugin documentation adds important governance context. Plugins that use apps inherit the app's role access, read-or-write boundaries, action controls, confirmation requirements, source-system permissions, and other available settings. OpenAI tells administrators to inspect what an app can search or fetch, what actions it can take, and whether it can sync data. It recommends keeping an initial rollout read-only where possible, limiting access to a pilot group, and reviewing legal, security, privacy, data-residency, and vendor requirements for sensitive systems.

OpenAI's current enterprise privacy commitments say it does not train its models on Business, Enterprise, Edu, Healthcare, Teachers, or API business data by default. That page specifically says the default no-training commitment covers data accessed from apps. It also says app use can send and retrieve information from connected sources, and that administrators control which apps are enabled.

Those statements establish a meaningful training boundary. They do not mean message content is never processed, never included in a task, never stored in a conversation, or never available through an authorized workspace path. “Not used for training by default” answers one question. It does not answer every privacy question.

What Is Still Unclear

The release notes describe what the plugin can do, but they do not yet provide a Messages-specific technical or privacy guide with the detail a careful buyer would want.

The public sources reviewed do not specify:

the exact macOS permissions requested during setup;
whether a search can span every conversation visible to the signed-in macOS user or can be constrained to selected contacts and threads;
which fields are returned for a message search, such as sender, recipient, timestamp, reactions, link previews, or delivery state;
whether images, voice notes, documents, location shares, or other attachments can be read or added to task context;
whether a search returns only matched messages or surrounding conversation context;
exactly which retrieved content becomes part of a cloud Work or Codex conversation;
whether plugin-derived content has any storage path separate from the resulting conversation;
how deleting a Work or Codex conversation relates to message content previously retrieved from Messages;
whether administrators can require confirmation for every send in every supported configuration; or
whether OpenAI has completed a Messages-specific independent security assessment.

These are gaps in the public documentation, not proof of hidden collection. It would be equally misleading to claim that ChatGPT uploads an entire Messages database and to claim that no message content leaves the Mac. The confirmed capability requires ChatGPT to read or search selected message data and use the result to complete a task. The exact boundary of that exchange is what remains under-documented.

Does ChatGPT Upload Your Entire iMessage History?

OpenAI has not said that the plugin automatically uploads or permanently copies a user's complete Messages history. The official description says it can read and search conversations. That is a capability statement, not a claim that every message is transmitted for every task.

The safer mental model is query-based access with an uncertain public scope:

A user invokes the Apple Messages plugin from Work or Codex.
The plugin accesses Messages data that the signed-in user and macOS permissions allow it to reach.
It retrieves content needed to answer the request or prepare an action.
ChatGPT uses that content as task context.
If the user asks to send, the plugin passes an approved message to Messages.

Steps two through four are where the missing detail matters. A narrowly scoped search for “find the address Alex sent yesterday” may expose much less than “summarize everything my team said about the acquisition.” The second request could deliberately bring a large volume of sensitive conversation into the task even if the plugin never copied the complete local database.

Privacy therefore depends on what you ask, what the plugin can reach, what the workspace retains, and what administrators permit. An app does not need to ingest everything to reveal something important.

What Kinds Of Data Could Messages Expose?

Messages is not merely a casual-chat application. For many people it is a mixed archive of personal and professional life. It may include:

names, phone numbers, email addresses, and relationship details;
account-recovery codes and one-time authentication codes;
medical appointments, symptoms, prescriptions, or insurance discussions;
financial questions, payment details, purchase confirmations, and debt discussions;
home addresses, travel plans, location shares, and daily routines;
workplace decisions, customer names, contract terms, and nonpublic projects;
school, childcare, and family information involving other people;
photos, documents, audio messages, and links; and
old statements that are no longer accurate but remain searchable.

That last point is easy to miss. A message archive contains information about correspondents who did not choose to connect their messages to an AI assistant. A workspace's training promise may protect the organization's use from default model training, but it does not erase the organization's responsibility to decide whether employees should bring third-party communications into an AI task at all.

An administrator should treat Apple Messages as a high-sensitivity source, not as a generic productivity app.

Is iMessage End-To-End Encryption Enough?

No. End-to-end encryption protects an iMessage while it travels between participating Apple devices. It does not stop an authorized application on an unlocked endpoint from reading content that the user can already access.

This is a classic endpoint boundary. Encryption can protect a message from network interception and unauthorized intermediaries while the plaintext remains available on the sender's and recipient's devices. Once a user authorizes software on the Mac to read that plaintext, the relevant question becomes what that software can access and what it does with the result.

SMS and RCS also have different delivery and encryption properties from iMessage. The ChatGPT feature description groups all three conversation types under the Messages plugin, but users should not infer that Apple's iMessage encryption applies identically to every message the app displays.

The plugin does not “break iMessage encryption.” It uses an authorized local access path after Messages has made the content available on the Mac.

Does OpenAI Train On Messages Read By The Plugin?

For the documented Business, Enterprise, and Edu workspace release, OpenAI says no by default. Its enterprise privacy page says business data is not used to train its models by default and explicitly includes data accessed from apps in that commitment.

Three limits belong next to that answer.

First, no training is not no processing. The system must process retrieved message content to search it, summarize it, draft a response, or complete the user's request.

Second, no training is not zero retention. OpenAI says Enterprise and Edu administrators control workspace retention and that deleted conversations are removed from its systems within 30 days unless legal retention is required. For Business, it says administrators can control retention and that deleted or unsaved conversations are removed within 30 days unless a legal requirement or service-protection need justifies longer retention. The public page does not provide a Messages-specific exception or separate plugin-derived-data schedule.

Third, the feature announcement is for managed business and education workspaces. A future consumer release, if one appears, could have different settings and terms. Do not transplant the Business, Enterprise, and Edu promise onto an undocumented consumer version.

What Happens When ChatGPT Sends An iMessage?

OpenAI says ChatGPT asks the user to approve the message and recipients by default before sending. That confirmation is an important safety boundary because a send action can be difficult to undo and can expose information to the wrong person.

The phrase “by default” deserves attention. It describes the starting behavior; it is not the same as a public guarantee that every administrator must preserve confirmation for every send action forever. OpenAI's generic plugin documentation says administrators can configure action controls and confirmations where those controls are available. The Messages release note does not publish the complete action-control matrix.

Users should inspect three things at the confirmation step:

Recipients: Check every person and group, not just the first visible name.
Content: Read the exact draft, including quoted material and context the model added.
Attachments and links: Confirm that nothing sensitive, stale, or unintended is included.

An AI-generated draft can be fluent and still be wrong. It may misidentify which “Alex” you meant, select an old group thread, summarize a private message too broadly, or add a confident detail that no one actually said. Approval is a decision point, not a cosmetic click.

Could A Message Contain Prompt Injection?

Potentially. Any assistant that reads untrusted text and can take actions must consider instructions hidden inside that text.

A message might contain ordinary prose, a forwarded instruction, a malicious link, or content crafted to influence an AI system. The public Apple Messages release notes do not describe a specific prompt-injection defense, and no source reviewed establishes that the plugin has been exploited. That means two claims should be avoided:

do not claim that a known Apple Messages prompt-injection attack is active without evidence; and
do not assume that human send approval makes every read, search, summary, or draft harmless.

The strongest control is to separate reading from acting. A read-only pilot limits the consequences if retrieved text confuses the model. Sending should remain a distinct, deliberately approved step with the recipient and exact content visible.

A MESSAGE Checklist Before You Enable It

Use MESSAGE to review the feature without turning a convenience decision into an unlimited data grant.

M — Minimize The Scope

Start with a small pilot group and a narrow use case. “Find scheduling details in a known work thread” is easier to evaluate than “manage all my messages.” If the available controls cannot isolate approved conversations or identities, treat that as a risk decision rather than assuming the plugin is narrowly scoped.

E — Examine Permissions

Record the exact macOS prompts, ChatGPT workspace settings, role assignments, and app controls shown during setup. Verify what changes when permissions are denied or revoked. Do not rely on a marketing description as the complete permission inventory.

S — Start Read-Only

OpenAI's plugin guidance recommends keeping a first rollout read-only when possible. Test search quality, over-retrieval, namesakes, group-thread selection, and sensitive-content handling before enabling send actions.

S — Separate Work And Personal Context

A Mac signed into a personal Apple account may mix family, health, financial, and work conversations. If organizational policy expects a clean work boundary, the device and Apple-account design matter as much as the ChatGPT toggle. A workspace control cannot retroactively separate data that is already mixed in Messages.

A — Approve Every Recipient And Draft

Keep confirmation enabled. Read the entire message and verify the complete recipient list. Treat group chats, legal commitments, financial instructions, health information, credentials, and customer data as high-risk sends requiring an independent check.

G — Govern Retention And Access

Confirm the workspace retention policy, audit access, role assignment, offboarding process, and incident-response path. Ask whether plugin-derived content appears in ordinary Work or Codex conversations and how those records are exported or deleted. Document unanswered questions before production use.

E — Exit And Verify

Test disabling the plugin, revoking macOS access, removing a user's role, and deleting a task conversation. Then verify the result from the user's account and the administrator's available records. A disabled plugin blocks future use; it does not automatically prove that every earlier task record or local artifact has disappeared.

Questions Administrators Should Ask OpenAI

The following questions turn “we reviewed the feature” into a testable record:

What exact macOS permissions does the Apple Messages plugin require?
Can administrators restrict it to read-only access and force confirmation for every send?
Can access be limited by user, group, role, Apple account, contact, or conversation?
What message fields and attachment types can the plugin retrieve?
How much surrounding context is returned for a matching search result?
Which retrieved content is sent to OpenAI and which processing occurs locally?
Does plugin-derived content become part of a cloud Work or Codex conversation?
Does any cache, index, temporary file, log, or derived summary use a separate retention schedule?
How do deletion, workspace retention, legal holds, exports, and the Compliance API apply?
What audit event records a search, read, draft, approval, send, permission change, or failed action?
What prompt-injection and wrong-recipient tests were performed?
What happens to access and existing records when a user is offboarded or the plugin is disabled?

A sales or support answer should be saved with the date and applicable plan. Product behavior and documentation can change.

Where OpenVeil Fits—and Where It Does Not

OpenVeil is useful when the safer answer is to use a narrower AI workspace instead of connecting a broad personal message archive.

In OpenVeil, normal chat history is stored in the user's browser, and the service does not keep a normal server-side chat-history record. Personas and their documents are also stored in the browser. OpenVeil says it does not use prompts, uploads, generated media, or outputs to train foundation models. Users can choose supported models and bring selected local history into an active request when they need continuity.

That creates a smaller standing data surface than an assistant designed to search and act across Apple Messages. A user can copy only the passage needed for a task, remove identifying details, or describe the situation without granting message-app access.

The boundary matters. OpenVeil is a hosted service, not a fully offline or anonymous system. Active prompts, uploads, selected local history, media, and outputs still require processing by OpenVeil and necessary providers. OpenVeil is not zero-log, HIPAA compliant, a macOS permission manager, an iMessage security product, a prompt-injection filter, or a guarantee that information you intentionally submit cannot be exposed through another risk.

OpenVeil also does not connect to Apple Messages or send messages on your behalf. That is the point of the comparison: fewer integrations can mean less convenience, but also less standing authority.

Frequently Asked Questions

Can ChatGPT read my iMessages now?

Eligible Business, Enterprise, and Edu users can use the Apple Messages plugin from ChatGPT Work or Codex on an Apple-silicon Mac. OpenAI says the plugin can read and search iMessage, SMS, and RCS conversations. It is not documented as an automatic feature for every ChatGPT user.

Can ChatGPT send an iMessage for me?

Yes. OpenAI says the plugin can prepare or send messages through Messages. By default, ChatGPT asks the user to approve the message and recipients before sending.

Does ChatGPT copy my entire message history?

OpenAI has not said that the plugin automatically copies or permanently stores the complete Messages database. The documentation confirms read and search access but does not yet publish enough detail to establish the precise retrieval scope, context window, caching, or plugin-specific retention behavior.

Are messages used to train OpenAI models?

OpenAI says Business, Enterprise, and Edu business data—including data accessed from apps—is not used for model training by default. That does not eliminate processing or retention associated with a Work or Codex task.

Can my employer see messages ChatGPT retrieves?

OpenAI says workspace members can view their own conversations, while administrative and compliance access varies by plan. Business administrators can view, access, export, and delete end-user conversations. Enterprise and Edu administrators have supported audit and Compliance API paths. The public Messages materials do not specify a separate visibility rule for plugin-derived content, so organizations should confirm how it appears in task records before enabling access.

Does the plugin break iMessage encryption?

No evidence reviewed suggests that. End-to-end encryption protects iMessage in transit. The plugin uses authorized access on a Mac where Messages can already display the plaintext to the signed-in user.

Can an administrator turn Apple Messages off?

Yes. OpenAI says Business, Enterprise, and Edu workspace administrators can disable Apple Messages through the existing Computer Use control. Administrators should also review plugin availability, role access, read/write actions, and confirmation settings.

Is this a ChatGPT or Apple data breach?

No breach is reported in the sources reviewed. This is a product capability and permission change. Its importance comes from the sensitivity of the data it can reach, not from evidence that attackers stole messages.

The Bottom Line

ChatGPT's Apple Messages plugin is a meaningful expansion of assistant authority. It can search private conversations and move from reading to drafting and sending through the same interface. OpenAI has documented a default send-confirmation step, administrator controls, source-permission inheritance, and a no-training-by-default commitment for business data.

What it has not yet documented is just as important: exact macOS permissions, retrieval scope, attachment handling, task-context boundaries, plugin-specific storage, deletion linkage, and the complete control matrix for sending.

That is not a reason to invent a breach. It is a reason to pilot carefully. Keep access narrow, begin read-only, preserve confirmation for every send, separate work and personal identities where possible, test revocation and deletion, and do not put message content into an AI workflow unless the task genuinely requires it.

If the use case only needs a private place to think, draft, or analyze selected text, a narrower tool with browser-local normal chat history—such as OpenVeil—can reduce standing access. It cannot eliminate the risks of content you choose to submit, but it lets you avoid granting an assistant a searchable route into the rest of your Messages archive.

Sources

When privacy, account control, uploads, and search matter, OpenVeil gives you a private AI workspace designed for that job.