ChatGPT's Apple Messages plug-in: read the approval setting
OpenAI's ChatGPT Apple Messages plug-in can draft, send and delete texts as you. The feature isn't the news. The persistent-approval toggle is, and it's a lesson for anyone building agents.
The ChatGPT Apple Messages plug-in lets OpenAI's chatbot draft, send, search and delete texts on your behalf, according to TechCrunch's report on 20 August 2026. Most of the coverage treats this as a convenience feature.
I read it differently. Buried in the same story is OpenAI telling users not to turn on persistent approval. That warning is the actual product, and it's the part worth copying if you build anything agentic.
🔍 What OpenAI actually shipped
Here's what the reporting establishes, separated from what it doesn't.
| Claim | Status |
|---|---|
| Sort, analyse and edit messages from inside ChatGPT | Confirmed |
| Suggest follow-ups based on messages received the previous day | Confirmed |
| Draft and send messages on your behalf | Confirmed |
| Delete messages on your behalf | Confirmed |
| Search your message history | Confirmed |
| Works with ChatGPT, ChatGPT Work and Codex | Confirmed |
| Runs locally, no index of all your messages | OpenAI's statement to Bloomberg |
| macOS versions, rollout dates, pricing tiers | Not stated in the source |
I'm flagging that last row deliberately. I don't know which OS builds this needs or what it costs, and neither does the article. If you see a blog post confidently listing version numbers for this, someone made them up.
OpenAI told Bloomberg the plug-in "runs locally on a user's machine" and "doesn't create an index of all someone's messages." Local execution is a meaningful privacy property. It is not the same as "your messages never leave the machine," and the source doesn't clarify which one is true.
⚠️ The permission set is unusual, and that's the story
Look at the capability list again as a permission grant rather than a feature list. This plug-in gets read, write and delete on a channel that carries your identity. Very few tools you install get all three on the same surface.
That combination has a specific failure mode:
- Someone sends you a message. You did not write it and did not vet it.
- Your agent reads that message as part of "summarise yesterday's texts."
- The message contains instructions rather than conversation.
- The agent has send rights on the same channel it just read from.
That's a closed loop with an attacker on one end. It's the reason OpenAI's own advice is to keep a human in it:
OpenAI "discourages turning on persistent approval, warning that doing so removes your final chance to review a message before ChatGPT sends it as you."
Read that phrase carefully: as you. Not "from an assistant," not with a bot label. A message that lands in your friend's thread with your name on it, indistinguishable from one you typed. Delete rights make it worse, because the audit trail can be removed by the same process that misbehaved.
Key takeaway: An inbox is untrusted input. The moment an agent can both read from a channel and write to it under your identity, every message you receive becomes a potential instruction, and the only reliable defence available today is a human clicking approve.
🌐 Why this matters in Sri Lanka, where nobody uses iMessage
Practically speaking, this specific plug-in is irrelevant to most people reading this. Apple Messages is not how Sri Lanka communicates. WhatsApp is, with SMS holding on for OTPs and bank alerts.
So the feature isn't the point. The pattern is, and the pattern travels:
| Channel | Local relevance | What an agent with send rights could do |
|---|---|---|
| Apple Messages | Very low here | Reply as you to personal threads |
| Extremely high | Reply as you to family, clients, groups, work | |
| SMS | OTPs, bank alerts, gov notices | Read one-time codes; reply to shortcodes |
| High for work | Send on your behalf, delete evidence |
The SMS row is the one that should make you uncomfortable. In Sri Lanka, SMS is the second factor for banking, for eGov services, for almost everything. Any assistant with read access to your SMS inbox has read access to your OTPs. Nobody has shipped that integration in the story I'm commenting on. Someone will.
If you're a freelancer or run a small team here, the realistic version of this arriving on WhatsApp is genuinely useful: triage 200 unread client messages, draft replies, flag what needs you. I'd use it. I'd also never leave it unattended on the account that talks to clients.
🛠️ If you're building agents, copy the gates, not the demo
I've built and run an AI assistant on a WhatsApp number, so this isn't hypothetical for me. The demo is the easy half. Here's what I'd insist on before any agent gets send rights on a real channel:
- Separate read scope from write scope. They're different permissions with different blast radii. Bundling them is a design choice, not a requirement.
- No blanket approvals. Per-action confirmation, or a time-boxed window that expires. "Always allow" is where incidents come from.
- Treat inbound content as data, never as instructions. Fence it in your prompt, and never let text that arrived from a third party reach a tool call unreviewed.
- Make destructive actions non-agentic. Delete and archive should require a human, always. There is no summarisation task that needs delete rights.
- Log every send with the input that triggered it. If you can't reconstruct why the agent sent something, you can't debug it or defend it.
- Cap it. Rate-limit sends per hour and per contact. A runaway loop that fires once is embarrassing; one that fires 400 times is a different conversation.
Two practical notes. If you're piping message content into a model API for testing, strip identifiers first. Our PII redactor runs in the browser and does that without sending anything anywhere. And before you assume an always-on triage agent is affordable, price the loop honestly with the AI agent cost calculator. Agents that re-read a growing conversation on every turn get expensive faster than most people estimate.
💡 What this means for you
- If you're a user: this is a real convenience with a real tail risk. Leave approval on. The five seconds you save per message is not worth the one message you didn't get to read before it went out under your name.
- If you're a student or engineer: the interesting engineering here isn't the integration, it's the permission model around it. When a company as far ahead as OpenAI ships a feature and simultaneously tells you to keep the safety rail on, that's an admission that the underlying problem is unsolved. Prompt injection against agents with write access has no clean fix today. Building the gate is the work.
- If you're a small-team builder: assume this pattern reaches WhatsApp within a year, and decide now what your team is allowed to automate on a client-facing number. Write it down before the feature exists, not after someone's agent sends something you can't take back.
Bottom line: the headline is that ChatGPT can text for you. The story is that OpenAI shipped it with a warning attached, and the warning is the more useful piece of engineering.