Sponsored by
THE USEFUL TECH
📘 THE DEEP DIVE · WEDNESDAY TUTORIAL · ISSUE #007
👋 HEY, IT'S RAJA
Last Thursday, OpenAI shipped a plugin for the ChatGPT desktop app on Mac that lets ChatGPT read, search, draft and send your messages. Not just iMessage. SMS and RCS too. It can summarise threads, tell you what you missed, and reply on your behalf.
Most of the coverage framed this as a convenience feature with a privacy question attached. I think that has it backwards. The convenience is real and quite small. The permission it asks for is enormous, and it is worth understanding exactly what you would be handing over before you decide.
This is not an argument that you should not use it. It is an argument that you should know what you are agreeing to, which is a different thing.
Two Congress Passes for the Price of One
Code 2FOR1 gets you two WeAreDevelopers World Congress passes for the price of one — so don't make the trip to Silicon Valley solo.
San José, CA · September 23–25, 2026. 10,000+ developers, 500+ speakers, 20+ stages, and the full software development lifecycle in one place.
On stage: Kelsey Hightower, Thomas Dohmke (former GitHub CEO), Christine Yen (Honeycomb), Olivier Pomel (Datadog) — the people building the tools you use every day. Three days of AI, agents, cloud, security, and architecture, plus workshops, live coding, and the official Congress party.
Bring the builder you'd want in the room with you.
📘 Every message you have ever sent
How the ChatGPT Messages plugin actually works, the permission underneath it, and the question nobody is asking.
What it actually does
It lives in the ChatGPT desktop app for macOS. Once enabled, you can ask it to catch you up on conversations you missed, find a date buried in a thread from March, draft a reply, or send one.
The genuinely reassuring part: it runs locally. OpenAI built it on native macOS tools, AppleScript and Accessibility services, so it operates on your machine rather than shipping your message database somewhere. And by default it only sends after you approve both the message and the recipients. OpenAI explicitly discourages setting up persistent approval.
⚠️ That default can be switched off. If you turn off per-message approval for convenience, you have given a language model the ability to send messages as you, to anyone in your contacts, without a human looking at them first. I would not do this, and I would think carefully about anyone who does.
The permission underneath it
To work, the plugin needs Full Disk Access and system-level permissions on your Mac.
Full Disk Access is not a scoped permission. It is not "access to Messages." It is the master key. Your Messages database is one thing behind that door, and everything else on your Mac is behind it too. macOS deliberately makes this permission difficult to grant precisely because it cannot be granted narrowly.
And the Messages database itself is bigger than people picture. It is not the last week. It is every conversation you have not manually deleted, going back years, across every device signed into your account. Photos and attachments sent to you. Your two-factor codes. The thread from when a relationship ended. The thread with your accountant.
The question nobody is asking
Here is the part that changed how I think about this, and it has nothing to do with OpenAI's data handling.
You can consent to an AI reading your messages. You cannot consent on behalf of the person who sent them to you.
Every thread in that database has at least two people in it. The friend who told you something in confidence, the colleague who forwarded something they should not have, the family member working through something difficult over text. None of them agreed to this. None of them will be told. They made a judgement about what to write to you, on the reasonable assumption that it was going to you.
This is not a hypothetical harm and it is not solved by local processing. It is a structural feature of granting any assistant access to a two-way medium, and it applies just as much to Apple's own upcoming Siri features as it does to OpenAI's plugin. But it is the first question I would want answered, and it is not in anybody's FAQ.
Why encryption is not the point
You will see people respond to this story with "iMessage is end-to-end encrypted." That is true and it is not relevant.
Encryption protects a message in transit, between two endpoints. This plugin operates at an endpoint, with your permission, after decryption. Nothing has been broken. The concern is not that someone intercepted your messages. It is that an authorised assistant can move information beyond the place you expected it to stay.
Encryption and endpoint access address completely different threats. Confusing the two is how people end up feeling protected by a guarantee that was never about this.
What Apple does next
Apple is in an awkward position and there is no clean way out of it.
It could restrict the access, which invites the accusation that it is blocking a competitor while building the same capability into Siri. It has form here: it shut down Beeper Mini for reaching into iMessage. It could allow it, which sits uncomfortably against a decade of privacy marketing. And whatever it chooses, smaller developers will immediately ask why a large partner gets access they cannot have.
The timing sharpens all of this. Apple and OpenAI are already in a legal dispute over trade secret allegations, and Apple's own AI messaging features are weeks from shipping.
So should you turn it on?
My honest position, and you may land somewhere else:
If you use it, keep per-message approval on. Non-negotiable. The convenience you gain by removing it is trivial next to what you give up.
Ask what your Messages history actually contains before granting Full Disk Access, not after. If the honest answer is "years of things other people told me privately," that is your answer.
Treat the read features and the send features as separate decisions. Summarising what you missed is a much smaller ask than composing on your behalf.
Revisit it in a month. Reporting differs on exactly which ChatGPT plans this reaches, and several data-handling questions have not been answered publicly yet: what content leaves your Mac, how long anything persists, whether deleting a ChatGPT conversation removes the underlying records. Those answers should exist before this becomes a default part of anyone's workflow.
Doing this deliberately instead of by accident
Giving an AI real control of your Mac is a legitimately useful thing to do. It is also a thing worth doing with a clear head about scope, permissions, and where you draw the line. The Claude Computer Use Playbook for Mac is the guide I wrote for exactly that: what to grant, what to withhold, and how to set up an assistant that can genuinely act on your machine without you handing over the whole thing. It is $39.
See you Friday, where we go through the five Mac permissions worth auditing this weekend. Full Disk Access is only the first one.
Keep it useful,
Raja · The Useful Tech
P.S. Enjoyed this? Forward it to a friend who loves their Apple gear a little too much.