ChatGPT's Mac app can now read and send your iMessages, including on ChatGPT Work

OpenAI has shipped an Apple Messages plugin for the ChatGPT desktop app on macOS that can read and search a user's Messages chats and prepare or send messages, covering iMessage, SMS and RCS ^[1][2]. According to the release notes quoted by 9to5Mac, it is available on all plans, and it works in ChatGPT Work and Codex ^[3].

That last detail is the part worth reading twice. The plugin does not operate in regular ChatGPT chats, and it does not let anyone drive ChatGPT remotely by texting it ^[4]. So the read, search and send capability exists specifically in the work-branded and developer surfaces rather than in consumer chat ^[14]. For anyone running a fleet of Macs, this is not a consumer feature that happens to be nearby; it is an assistant inside the corporate tenant with a path to the message store where deal terms, on-call escalations, two-factor codes and vendor negotiations actually live.

The control OpenAI points to is approval. By default, ChatGPT sends a message only after the user approves both the text and the recipients ^[5]. The company's plugin guide covers the risks of persistent approval, how to revoke access, and a known issue in which tasks disable approval prompts ^[6]. Read plainly, that is a vendor telling you the default is safe, the opt-out of the default is not, and there is already one path where the prompt does not appear. Persistent approval is therefore a configuration question with a blast radius, not a convenience toggle: once a user grants it, an agent can send from their identity to their contacts, and the failure mode is a message that looks exactly like the human wrote it. Fleet scope is narrower than the plan scope suggests, because for now the feature runs on Apple silicon Macs and not Intel machines ^[7].

The same release includes other things that move data across boundaries. Pinned chats now stay in sync between the desktop app and iOS ^[8]. Users can share a read-only snapshot of a local Codex thread, frozen at the moment of sharing ^[9]. Links made from personal accounts are open to anyone holding the URL, while workspace links stay inside the workspace, and OpenAI says Codex redacts known secret patterns but advises reviewing snapshots because sensitive material can survive ^[10]. "Known secret patterns" is the operative limit there.

Elsewhere, Site owners can invite active members of the same workspace to co-edit, with editors able to change content and database data, save versions and publish after the owner's first publication, while owners keep access, settings, analytics and version restoration ^[11]. Some owners can also change a ChatGPT-hosted URL without redeploying, with the old address redirecting to the new one ^[12]. The Computer History feature is expanding to Pro, Business and Enterprise users in the EEA, Switzerland and the UK; it requires Memories and stays off by default ^[13].

What to watch: whether admins get a tenant-level control to block the Messages plugin or persistent approval outright, rather than relying on each user reading a plugin guide; how quickly the known task issue that disables approval prompts is closed ^[6]; and whether the personal-versus-workspace split on snapshot links ^[10] holds up when employees share Codex threads from personal accounts. Also watch the Intel cutoff ^[7], since it is the only thing currently keeping this off older corporate hardware.