ChatGPT Can Now Send Your Texts — Inside OpenAI’s New Apple Messages Plug-In

Introduction: The Week AI Moved Into Your Apps

On August 20, 2026, TechCrunch reported that OpenAI has launched an Apple Messages plug-in for ChatGPT, letting users connect their Messages inbox directly to the chatbot. Once connected, ChatGPT can sort, analyze, edit, draft, send — and even delete — your texts.

It lands at the end of a remarkable week for AI autonomy: Binance shipped Agent OS so agents can trade crypto for you, Meta put a screen-aware AI app on the Mac, and OpenAI spent days explaining a safety overhaul triggered by a rogue agent. The through-line is unmistakable — 2026's assistants don't just answer questions, they operate your software. Your texts are simply the most personal app they've reached yet.

What the Apple Messages Plug-In Actually Does

Think of the plug-in as giving ChatGPT a set of hands inside Apple Messages. According to TechCrunch's report, connected users can:

• Sort and analyze their inbox — triaging threads, summarizing conversations, editing message content.
• Suggest follow-ups — a promotional spot shows a user asking ChatGPT to propose replies to contacts based on messages received the previous day.
• Draft and send messages on your behalf — the assistant composes the text and ships it, with your approval.
• Delete messages for you, tidying conversations on command.
• Search deep history — surface that address or promise buried in a thread from two years ago.

Notably, it isn't consumer-only: the plug-in also works with Codex and ChatGPT Work, so teams can point it at professional workflows — follow-ups, scheduling, searchable team history — not just personal chats.

The Privacy Story: Local, But Light on Details

Handing an AI lab the keys to your message archive deserves specifics, and those are still thin. OpenAI told Bloomberg that the plug-in runs locally on a user's machine and “doesn't create an index of all someone's messages.” That local-first framing matters — it suggests content isn't shipped wholesale to OpenAI's servers — but as TechCrunch notes, what that means in practice isn't immediately clear, and the publication has asked OpenAI for more detail.

Until that picture sharpens, the honest posture is cautious optimism: local execution is the right architecture, and “no full index” is the right promise — but sorting and searching inherently require processing some message content, and how much stays on-device is the question worth watching.

The Approval Dial — and the Setting OpenAI Warns Against

The most telling detail in the announcement isn't a feature — it's a warning. When it comes to sending messages, OpenAI encourages users to keep an eye on what ChatGPT is doing and explicitly discourages turning on persistent approval, cautioning that it “removes your final chance to review a message before ChatGPT sends it as you.”

That's a strikingly blunt admission of where the risk lives. Per-message approval is friction, but it's the last line of defense between a plausible-sounding AI draft and a message your contacts will read as your words — the same human-in-the-loop principle that governs agent trades and every autonomous action with real-world consequences. When the action is speaking as you to people you know, the case for that final review is at its strongest.

Why Messaging Is the Real Prize in the Assistant Wars

Messaging is the highest-frequency, most personal app on your phone. The assistant that manages your texts earns a daily habit no chatbot-only interface can match — which is why this launch reads as a land grab, not a convenience feature.

It also completes a pattern. Dictation tools like Wispr Flow and Superwhisper normalized AI in the input layer; screen-aware assistants normalized AI observing your apps; agentic platforms normalized AI acting on your behalf. A Messages plug-in fuses all three: observe the thread, reason over it, act in it. Expect Google and Meta to answer with their own inbox integrations — and expect “can it handle my messages?” to become a standard line in assistant comparisons.

What Could Go Wrong When an AI Texts as You

Three risks are worth naming before you connect anything:

• Prompt injection: an incoming text is untrusted input. A crafted message — from a stranger or a compromised contact — could steer your agent into acting on the attacker's instructions. Agents that read messages and act inherit every manipulation trick that works on humans.
• Impersonation and authenticity: contacts believe texts from your number are you. An AI-drafted reply that misjudges tone or commits you to something carries your reputation with it — disclosure norms will need to evolve fast.
• Irreversible actions: sent is sent, deleted is deleted. A misread thread plus an over-eager cleanup command can erase records you needed. Approval gates exist precisely for actions without an undo key.

A Practical Safety Checklist for Inbox Agents

If you connect your Messages — today or when competitors inevitably arrive — a five-minute setup buys most of the safety:

• Keep per-message approval on. Resist the persistent-approval toggle; review before send is the whole game.
• Read before you approve. Check the recipient and the content — wrong-thread sends are the classic failure.
• Treat inbound texts as untrusted. If a message contains instructions, links, or urgency, handle it yourself.
• Gate destructive commands. Deletions deserve the same scrutiny as sends — confirm scope first.
• Separate work and personal contexts. Use ChatGPT Work for professional threads so data handling matches your company's policy.

Frequently Asked Questions