One dialog, everyone's archive: the Messages plugin breaks consent at the boundary

Take OpenAI's account of the plugin at face value: local by default, no automatic upload, no index, no reading until the user asks for something from Messages ^[2]. Every one of those assurances is about vendor handling. None of them is about authorisation. The macOS permission sheet knows exactly one human being, the one holding the laptop, and that person is the only one asked ^[5].

Look at what is actually granted. AppleScript, Accessibility and Full Disk Access ^[1] are device-level grants issued by the device owner, and Apple's consent model has no concept of the other people whose words are sitting in the store. A two-party thread produces one approval and one non-approval. A group chat produces one approval and everyone else ^[12]. The party who consents is never the only party whose data is reached, and there is no in-thread signal to the others: Walsh's point is that recipients "will never know that I have a third party inside that application, and they will never be notified" ^[6].

The encryption argument is where the two named experts converge despite the label fight. Richardson's description is the uncontroversial one: end-to-end encryption stops the network operator and the platform from reading or altering a message in transit, while the endpoints can still read it on arrival ^[9]. Walsh takes the same fact somewhere sharper, arguing that once another system reads the plaintext before encryption or after decryption, "you have broken the fundamental concept" ^[7]. Richardson thinks "spyware" is too strong, because spyware takes without permission and this ships off by default behind an explicit grant ^[8]. Walsh uses the word anyway ^[3]. Both of them agree the channel's guarantee thins out once a third party can read the decrypted archive ^[9].

The screenshot comparison is the one worth dismantling, because it is the defence that will be offered. Walsh draws the line himself: forwarding a text is breaking someone's trust, not letting a third party inside the conversation ^[10]. Mechanically, a screenshot is a single artefact selected by a person who read it first. Search across years of threads is a standing capability applied to material nobody selected, including messages sent long before the plugin existed ^[4].

For anyone running a business, the exposure sits in an awkward place. Your own device policy governs your machines. It does not govern the counterparty who installed the plugin on theirs, and confidentiality in a messaging thread is only as good as the least careful endpoint. Proton's analysis lands on the same asymmetry from the consumer side: people who never use ChatGPT can still have their messages read ^[11].