MacSouverain

FREN
radar

ChatGPT Reads Your Messages, and the Price Is Your Whole Disk

ChatGPT reads and sends your iMessages on Mac. The ticket in is Full Disk Access, the broadest permission in macOS.

The facts


OpenAI just wired ChatGPT into the macOS Messages app. Since August 20, 2026, on Apple Silicon Macs, the app reads your conversations, searches them, summarizes them, drafts a reply in your place and sends it, iMessage, SMS and RCS alike.

For now, the feature only lives in the app’s Codex and ChatGPT Work modes, not in ordinary ChatGPT conversations. And it’s not a matter of wallet, Codex is included even in the free plan, so the general public gets it too. Only Work mode stays reserved for paid accounts.


The mechanism is nothing exotic. OpenAI says everything runs locally, through AppleScript and Accessibility, with no separate index copying your messages elsewhere. On paper, nothing leaves for a server. But to dig into Messages, the app demands one specific permission, and not the most discreet one.


Full Disk Access.


It’s the broadest permission in macOS. All or nothing, no granularity. You don’t grant it “for Messages,” you grant it outright. Once it’s ticked, the third-party app can read your Mail database, your Safari data, your Time Machine backups, far beyond the three blue bubbles you wanted summarized.

And it’s the second OpenAI feature in a matter of days to invite itself into the heart of your Mac. A week earlier, on August 13, Computer History was already logging your clicks and keystrokes through Accessibility, and storing them in plain text on your disk. The direction of travel is clear.


Why it matters to you


The real problem isn’t convenience. It’s consent, and who it belongs to.


You flip a setting on your end. And your whole correspondents’ history goes with it. They agreed to nothing, ticked nothing, read nothing. The person who wrote you something intimate three years ago ends up read and summarized by a model without ever being asked.

In this story, the victim is as much the person across from you as it is you.


OpenAI points to a safeguard, every send asks for your confirmation, message and recipients shown before it leaves. That’s true, and it’s good. Except the confirmation protects the sending, not the reading. The plugin has already read everything before the slightest confirmation window appears. The entire thread, not just the reply you’re about to type. Controlling the output changes nothing about what came in.


Then there’s the “it runs locally” argument. It’s real, and it doesn’t close the question. The weak point isn’t the transit, OpenAI doesn’t document what goes up, and “local” says nothing about what may end up in a request to the model the day you ask for a summary.

The real weak point is that Full Disk Access, for its part, stays granted permanently. Local today says nothing about tomorrow’s update. The door is open, and what goes through it is a decision that escapes you.


Read next: MCP, the backdoor into your AI


What you do now


1. Open System Settings, Privacy and Security, Full Disk Access. Look at who’s on the list. If a third-party AI assistant is there, untick it. This permission isn’t lent out for a writing convenience.


2. Do the same round in Automation and in Contacts, same Privacy and Security panel. AppleScript and Accessibility go through there, an app that drives Messages needs those accesses, cut whatever has no business being there.


Read next: Privacy on macOS, to effectively protect your digital life


3. Keep Messages out of a third-party agent’s reach. Your conversation threads contain other people’s, you have no mandate to hand them over. If you really want an assistant on your Mac, favor what genuinely runs on-device, without demanding full disk access.


Read next: An AI agent can wreck your fleet, the lock with Touch ID


4. Come back to these three panels now and then. An update, a new feature, and an app re-wires an access you thought was closed. Vigilance is something you replay.


Sources