OpenAI has shipped an Apple Messages plugin for the ChatGPT desktop app on macOS, letting the chatbot read and search a Mac’s iMessage, SMS, and RCS conversations and prepare or send texts through the Messages app itself. The feature landed August 20, 2026, in the company’s release notes, and it works inside Codex and ChatGPT Work (the agentic surfaces OpenAI has been building out all year) rather than in ordinary ChatGPT chats.
The plugin is available on all plans, but with a hard hardware boundary: it ships only in the Apple Silicon (arm64) build of the desktop app, so Intel Macs are out, and it does nothing in ChatGPT on the web or mobile, Codex CLI, or the IDE extension. After installing it from the Plugins tab, a user starts a new Codex or Work chat and asks it to find, summarize, draft, or send a message. ChatGPT requests the relevant macOS permissions before touching Messages, and the user reviews both the message and its recipients before anything goes out.
That send approval is the product’s central design decision. By default, ChatGPT sends a message only after the user approves the content and the recipients — an “Allow once” choice per send. Users can instead select “Always allow sending to this chat,” which lets ChatGPT fire off future messages to that thread without asking again. OpenAI’s own plugin documentation actively discourages the persistent setting:
“Keep per-send approval for chats that may contain untrusted or misleading instructions. Persistent approval removes your final chance to review a message before ChatGPT sends it as you.”
The warning is prompt-injection hygiene in plain language: a text thread is untrusted input, and a chatbot with standing authority to send messages as you is a channel an attacker can steer. Users who enable persistent approval can revoke it under Settings, in the Computer Use section, by removing the chat from the always-allowed list. The documentation also flags a known issue: tasks configured with full access or otherwise stripped of approval prompts may leave Messages unable to display the send confirmation, and OpenAI’s remedy is to switch the task back to an approval mode.
What the Plugin Actually Does, and Where It Stops
The capability set is narrower than the phrase “ChatGPT can text for you” suggests. The plugin can read and search message history on the Mac, draft follow-ups and replies, and send them through Messages with approval. It cannot turn Messages into a remote control for ChatGPT — texting the chatbot from your phone is explicitly not part of the release — and it stays out of regular ChatGPT chats entirely. Analyzing threads and pulling information out of old conversations sit in the same read-and-search envelope, while sending requires approval.
For managed deployments, workspace administrators can switch Apple Messages off through the existing Computer Use control, the same mechanism that governs other desktop-agent capabilities. That admin hook matters for the product’s enterprise posture: OpenAI has told investors that its enterprise revenue has overtaken the ChatGPT consumer business, and features that touch personal data on a work machine live or die by whether IT can gate them.
OpenAI’s Desktop-Agent Buildout
The Messages plugin is one tile in a larger mosaic. Since July 2026, OpenAI has folded Chat, Work, and Codex into a single desktop app, launched ChatGPT Work as its long-running task agent, replaced the app directory with a plugin directory, and added computer-use features that let Codex operate Mac and Windows applications with permission. Earlier this month it extended that consumer surface in a different direction with ChatGPT for Teens, a tier with default protections and learning tools.
Plugins are the distribution layer for this strategy. The same universal directory serves ChatGPT and Codex across web, desktop, and mobile, with OpenAI-built plugins alongside workspace and personal marketplace entries, and connectors to services like Gmail, Google Drive, and Slack that authenticate separately and apply their own terms when data flows through them. Apple Messages is the deepest OS-level hook in that catalog so far: not a cloud connector to a third-party service, but an agent acting through the local messaging stack on the user’s own machine, with the send button gated by an approval prompt OpenAI is visibly reluctant to let users waive.
