OpenAI has released a Messages plugin that provides summaries of your conversations, detailing who you are speaking with and the topics discussed.

      The ChatGPT desktop application can now access your iMessage history and send messages for you. OpenAI introduced this integration this week for Macs with Apple silicon, and notably, Apple, a company reportedly facing a lawsuit from OpenAI, was not included in the announcement.

      The plugin allows reading and searching through Messages conversations on the device, encompassing iMessage, SMS, and RCS, and can draft and send responses. It also analyzes message archives, summarizing whom you communicate with and the topics discussed, which is a different function from composing a text and is considerably more intrusive.

      By default, sending messages requires explicit consent for each outgoing message, and OpenAI has indicated that this is the expected setting users should maintain. However, users can disable this feature, granting ongoing consent which allows the model to send messages without prior approval. OpenAI advises caution before doing so, which is unusual for a company to assert regarding a feature it has developed.

      There is also a known glitch. OpenAI has acknowledged that some actions can disable the approval prompt, indicating that the safety mechanism has a flaw that the company has documented but not resolved.

      This integration is accessible across all plans in the desktop app, with enhanced functionality available in ChatGPT Work and Codex. However, it does not support Intel Macs.

      Importantly, none of this required Apple's cooperation, which is significant to note. The Messages database resides on the local disk, and any application with the appropriate macOS permissions can access it. Thus, OpenAI has utilized an access pathway that Apple provides, rather than negotiating one.

      For a decade, Apple has promoted Messages with a focus on end-to-end encryption, which safeguards messages during transmission and on the device. However, this encryption does not shield messages from software that the user has permitted to access the decrypted database—a distinction that many people may not have considered.

      The context of the two companies' relationship makes this situation particularly notable. Over the past year, the collaboration with Siri has deteriorated, and this feature completely bypasses Siri on Apple's own hardware.

      Additionally, this aligns with a trend in OpenAI's recent offerings. The company has recently introduced a feature that logs keystrokes in plain text and has been encouraging users to link their bank accounts, each of which involves trading a type of private information for convenience.

      The privacy issue at hand is not solely about the user; it pertains to everyone included in the conversations, none of whom consented to have their messages summarized, and none will be informed about it.

      Group chats illustrate this concern vividly. If one participant activates the plugin, the entire conversation is exposed, including content from individuals who chose Messages specifically because they believed it was a private option.

      The enterprise version raises additional issues. Users of ChatGPT Work on managed Macs may have message archives containing both personal and work-related communications, and OpenAI has not provided guidance on how administrators should handle this.

      Furthermore, it is unclear what data leaves the device. While reading the database is done locally, the analysis that generates contact summaries is processed by the model, and OpenAI has not clarified in the release notes which conversation parts are sent for processing and which are retained locally.

      This leads to a significant gap in disclosure. A feature that accesses private communications should explicitly state where that correspondence is sent.

      Apple has not responded to the integration and lacks a clear method to block it, aside from altering how macOS allows access to the Messages database, which would simultaneously interfere with a number of legitimate applications.

      Ultimately, the creators of the encryption are not the ones determining who reads the decrypted messages. That responsibility now rests with whoever grants approval.