{"code":"var Component=(()=>{var p=Object.create;var s=Object.defineProperty;var u=Object.getOwnPropertyDescriptor;var g=Object.getOwnPropertyNames;var m=Object.getPrototypeOf,y=Object.prototype.hasOwnProperty;var k=(n,i)=>()=>(i||n((i={exports:{}}).exports,i),i.exports),f=(n,i)=>{for(var t in i)s(n,t,{get:i[t],enumerable:!0})},r=(n,i,t,o)=>{if(i&&typeof i==\"object\"||typeof i==\"function\")for(let a of g(i))!y.call(n,a)&&a!==t&&s(n,a,{get:()=>i[a],enumerable:!(o=u(i,a))||o.enumerable});return n};var b=(n,i,t)=>(t=n!=null?p(m(n)):{},r(i||!n||!n.__esModule?s(t,\"default\",{value:n,enumerable:!0}):t,n)),v=n=>r(s({},\"__esModule\",{value:!0}),n);var l=k((A,h)=>{h.exports=_jsx_runtime});var w={};f(w,{default:()=>d});var e=b(l());function c(n){let i={a:\"a\",code:\"code\",em:\"em\",h2:\"h2\",h3:\"h3\",img:\"img\",li:\"li\",ol:\"ol\",p:\"p\",pre:\"pre\",span:\"span\",strong:\"strong\",ul:\"ul\",...n.components};return(0,e.jsxs)(e.Fragment,{children:[(0,e.jsx)(i.p,{children:\"On 20 August 2026 OpenAI shipped an Apple Messages plugin for the ChatGPT desktop app on macOS. It can read and search your iMessage, SMS and RCS conversations, and it can draft and send messages on your behalf. It runs locally on your Mac, using AppleScript and macOS accessibility APIs rather than uploading your message database anywhere.\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"To enable it you have to grant ChatGPT three macOS privacy permissions: \",(0,e.jsx)(i.strong,{children:\"Full Disk Access\"}),\", \",(0,e.jsx)(i.strong,{children:\"Contacts\"}),\", and \",(0,e.jsx)(i.strong,{children:\"Automation\"}),\" for the Messages app.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"The second and third of those are scoped. The first is not, and that is the entire story of this article. Full Disk Access is not a Messages permission. It is the permission that removes almost every file-level privacy boundary macOS has, for that one app, permanently, until you revoke it. Once ChatGPT has it, the same grant that lets it read \",(0,e.jsx)(i.code,{children:\"chat.db\"}),\" also lets it read your Mail store, your Safari history and cookies, your Time Machine backups, and the private data folder of every other app on the machine.\"]}),`\n`,(0,e.jsx)(i.p,{children:`That is not a bug in OpenAI's implementation and it is not a criticism of the feature. It is how Apple designed the permission. But the setup flow presents it as \"so ChatGPT can read your Messages\", and the gap between what you think you are approving and what you are actually approving is worth understanding before you click.`}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.img,{alt:\"macOS privacy settings showing Full Disk Access\",src:\"/images/blog/chatgpt-apple-messages-plugin-mac-full-disk-access-privacy-2026/hero.webp\",width:\"1024\",height:\"541\"})}),`\n`,(0,e.jsx)(i.h2,{id:\"key-takeaways\",children:\"Key Takeaways\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Full Disk Access is not scoped to Messages.\"}),\" It is a single switch that exempts an app from most of the TCC file protections at once. Mail, Safari, Time Machine backups and other apps' container data all become readable.\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"ChatGPT.app is not sandboxed.\"}),\" We checked the entitlements on the shipping build: \",(0,e.jsx)(i.code,{children:\"com.apple.security.app-sandbox\"}),\" is \",(0,e.jsx)(i.code,{children:\"false\"}),\". An unsandboxed app with Full Disk Access has very few remaining file-level limits.\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsxs)(i.strong,{children:[\"The bundle identifier is \",(0,e.jsx)(i.code,{children:\"com.openai.codex\"}),\", not \",(0,e.jsx)(i.code,{children:\"com.openai.chat\"}),\".\"]}),\" If you want to reset its permissions from Terminal, that is the identifier you need, and getting it wrong silently resets nothing \\u2014 or, worse, resets the permission for every app on your Mac.\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Automation is the send permission.\"}),` ChatGPT's own usage string reads \"ChatGPT uses Apple Events to control Mac apps on your behalf.\" That is what actually drives Messages.`]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"The real-world risk is composition, not the plugin alone.\"}),\" PCWorld's hands-on found ChatGPT falling back to a previously-enabled computer-use capability and clicking Delete buttons in the Messages window when the plugin could not do the job. Nothing was breached; two separately-approved features simply combined.\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"You can audit and revoke all of this in about two minutes.\"}),\" The exact steps are below, including how to verify from Terminal that the revocation worked.\"]}),`\n`]}),`\n`,(0,e.jsx)(i.h2,{id:\"what-openai-shipped\",children:\"What OpenAI Shipped\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"The plugin appears in the ChatGPT desktop app's Plugins tab. Per OpenAI's description and the reporting around launch, it is available on all ChatGPT plans in the macOS app, and it works in ChatGPT Work and Codex contexts. It is \",(0,e.jsx)(i.strong,{children:\"Apple silicon only\"}),\" \\u2014 Intel Macs do not get it.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"Functionally it does four things:\"}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsx)(i.li,{children:\"Reads your Messages conversations.\"}),`\n`,(0,e.jsx)(i.li,{children:\"Searches them.\"}),`\n`,(0,e.jsx)(i.li,{children:\"Drafts a message for a recipient.\"}),`\n`,(0,e.jsx)(i.li,{children:\"Sends that message through Messages.\"}),`\n`]}),`\n`,(0,e.jsxs)(i.p,{children:[\"OpenAI's stated privacy posture, via a spokesperson quoted at launch, is that the plugin \",(0,e.jsx)(i.strong,{children:\"does not build an index\"}),\" of your texts, and that you must explicitly prompt ChatGPT to draw on message context before it reads a thread. Sending is gated by an approval step by default: ChatGPT shows you the message and the recipient, and you confirm.\"]}),`\n`,(0,e.jsx)(i.p,{children:'There is an option to make that approval persistent for a given conversation. OpenAI itself advises against it, in words that are unusually candid for a product setting \\u2014 enabling it \"removes your final chance to review a message before ChatGPT sends it.\"'}),`\n`,(0,e.jsx)(i.p,{children:\"Take that at face value. A vendor telling you not to use a convenience toggle it built is a vendor that has thought about what happens when the model misreads a thread.\"}),`\n`,(0,e.jsx)(i.h2,{id:\"the-three-permissions-and-what-each-one-really-does\",children:\"The Three Permissions, and What Each One Really Does\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"macOS gates all of this through \",(0,e.jsx)(i.strong,{children:\"TCC\"}),\" \\u2014 Transparency, Consent and Control \\u2014 the subsystem that owns every Privacy & Security pane in System Settings. We wrote a full mechanism guide to TCC in \",(0,e.jsx)(i.a,{href:\"/blog/mac-screen-recording-full-disk-access-permission-keeps-asking-fix-2026\",children:\"why your Mac keeps asking for Screen Recording permission\"}),\", and the model there applies directly here. The short version: TCC entries bind to an app's \",(0,e.jsx)(i.strong,{children:\"code-signing identity\"}),\", not to its path or its name, and each protected capability is a separate service with its own grant.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"contacts-narrow-and-well-behaved\",children:\"Contacts: Narrow and Well-Behaved\"}),`\n`,(0,e.jsx)(i.p,{children:`This one does what it says. It lets ChatGPT resolve \"message Sarah\" to a phone number or Apple Account. Apple's Contacts permission is scoped to the Contacts store and nothing else. If you are worried about your address book leaving the machine, that is a real question to ask OpenAI about its data handling \\u2014 but it is not a question about macOS permissions, because the permission itself grants exactly what it names.`}),`\n`,(0,e.jsx)(i.h3,{id:\"automation-the-send-path\",children:\"Automation: The Send Path\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"The Automation permission is what actually lets ChatGPT operate Messages. It authorises the app to send \",(0,e.jsx)(i.strong,{children:\"Apple Events\"}),\" to another app \\u2014 the same mechanism AppleScript has used for thirty years.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"We inspected the shipping ChatGPT build on a Mac (version 26.727.40816, checked 22 August 2026) and its \",(0,e.jsx)(i.code,{children:\"Info.plist\"}),\" declares this usage string verbatim:\"]}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:'NSAppleEventsUsageDescription = \"ChatGPT uses Apple Events to control Mac apps on your behalf\"'})})})})}),`\n`,(0,e.jsx)(i.p,{children:\"Its code-signing entitlements include:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"com.apple.security.automation.apple-events => true\"})})})})}),`\n`,(0,e.jsxs)(i.p,{children:[\"Note the wording in Apple's own dialog and in OpenAI's string: \",(0,e.jsx)(i.em,{children:\"control Mac apps\"}),', plural. Automation is granted per target application \\u2014 you approve \"ChatGPT wants to control Messages\" separately from \"ChatGPT wants to control Finder\" \\u2014 so this is scoped in practice. But it is scoped per ',(0,e.jsx)(i.em,{children:\"app you approve\"}),\", and each new approval is one more dialog you will be tempted to click through. Check System Settings \\u2192 Privacy & Security \\u2192 Automation occasionally and see what the list has grown into.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"full-disk-access-the-one-that-is-not-scoped\",children:\"Full Disk Access: The One That Is Not Scoped\"}),`\n`,(0,e.jsx)(i.p,{children:\"Here is the crux.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.img,{alt:\"macOS System Settings Privacy and Security pane\",src:\"/images/blog/chatgpt-apple-messages-plugin-mac-full-disk-access-privacy-2026/content-1.webp\",width:\"1024\",height:\"572\"})}),`\n`,(0,e.jsxs)(i.p,{children:[`Apple's Platform Security documentation describes the design intent plainly: users \"should have full transparency, consent, and control over what apps are doing with their data\", and file access is split into categories \\u2014 Desktop, Documents, Downloads, iCloud Drive, removable and network volumes \\u2014 that an app can request individually through a prompt. `,(0,e.jsx)(i.strong,{children:\"Full Disk Access is different.\"}),\" It is the category an app cannot prompt for. You have to go into System Settings and add the app by hand, precisely because it is broader than the others.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"What it covers is the set of locations macOS protects from ordinary apps regardless of Unix file permissions. That includes, among others:\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.code,{children:\"~/Library/Messages/\"}),\" \\u2014 the Messages database \",(0,e.jsx)(i.code,{children:\"chat.db\"}),\" and the \",(0,e.jsx)(i.code,{children:\"Attachments\"}),\" folder\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.code,{children:\"~/Library/Mail/\"}),\" \\u2014 the Mail store\"]}),`\n`,(0,e.jsx)(i.li,{children:\"Safari's cookie and history data\"}),`\n`,(0,e.jsx)(i.li,{children:\"Time Machine backup contents\"}),`\n`,(0,e.jsx)(i.li,{children:\"Other applications' protected container data\"}),`\n`,(0,e.jsx)(i.li,{children:\"The TCC databases themselves (read-only; more on that below)\"}),`\n`]}),`\n`,(0,e.jsxs)(i.p,{children:[\"You can prove the boundary on your own Mac in one command. From a Terminal that has \",(0,e.jsx)(i.strong,{children:\"not\"}),\" been granted Full Disk Access:\"]}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ~/Library/Messages/\"})]})})})}),`\n`,(0,e.jsx)(i.p,{children:\"On a stock Mac this returns:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"ls: /Users/you/Library/Messages/: Operation not permitted\"})})})})}),`\n`,(0,e.jsxs)(i.p,{children:['Not \"Permission denied\" \\u2014 ',(0,e.jsx)(i.code,{children:\"Operation not permitted\"}),\". That is TCC refusing, not the filesystem. We ran exactly this on macOS 26.5.2 (build 25F84) while writing this and got that result. Now grant Full Disk Access to Terminal and run it again: the directory lists. Nothing about the file's owner or mode changed. The only thing that changed is that one process is now exempt from the protection.\"]}),`\n`,(0,e.jsxs)(i.p,{children:['That is what you are handing to ChatGPT. Not \"read Messages\". ',(0,e.jsx)(i.strong,{children:\"Exempt from the protection.\"})]}),`\n`,(0,e.jsx)(i.h3,{id:\"and-it-is-not-sandboxed\",children:\"And It Is Not Sandboxed\"}),`\n`,(0,e.jsx)(i.p,{children:\"There is a second layer that would normally constrain a Mac app even with a broad TCC grant: the App Sandbox. A sandboxed app is confined to its own container and to the specific resources its entitlements name, and the sandbox is enforced by the kernel independently of TCC.\"}),`\n`,(0,e.jsx)(i.p,{children:\"We checked. On the build we inspected, ChatGPT.app's entitlements include:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"com.apple.security.app-sandbox => false\"})})})})}),`\n`,(0,e.jsx)(i.p,{children:\"Alongside:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"com.apple.security.cs.allow-jit => true\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"com.apple.security.cs.allow-unsigned-executable-memory => true\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"com.apple.security.network.client => true\"})})]})})}),`\n`,(0,e.jsxs)(i.p,{children:[\"The app is signed with a Developer ID (\",(0,e.jsx)(i.code,{children:\"Developer ID Application: OpenAI OpCo, LLC\"}),\", Team ID \",(0,e.jsx)(i.code,{children:\"2DC432GLL2\"}),\") and distributed outside the Mac App Store, where sandboxing is not mandatory. That is entirely normal for a desktop app with automation ambitions \\u2014 you cannot drive other apps from inside a strict sandbox. It is also common for Electron-style and JIT-using runtimes to carry the \",(0,e.jsx)(i.code,{children:\"allow-jit\"}),\" and \",(0,e.jsx)(i.code,{children:\"allow-unsigned-executable-memory\"}),\" exceptions.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"But the combination matters. \",(0,e.jsx)(i.strong,{children:\"An unsandboxed app plus Full Disk Access is close to the maximum file-read authority a non-root process can hold on macOS.\"}),\" If you were evaluating any other vendor's utility with that profile, you would want to know why it needed it. Apply the same standard here.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"You can verify all of this yourself:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsxs)(i.code,{children:[(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"codesign\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -dv\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --verbose=2\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Applications/ChatGPT.app\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"codesign\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -d\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --entitlements\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" -\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --xml\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Applications/ChatGPT.app\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" plutil\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -p\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" -\"})]})]})})}),`\n`,(0,e.jsx)(i.p,{children:\"Entitlements change between versions. Ours were read on 22 August 2026 from version 26.727.40816; check your own build rather than trusting a number in an article.\"}),`\n`,(0,e.jsx)(i.h2,{id:\"the-bundle-id-trap\",children:\"The Bundle ID Trap\"}),`\n`,(0,e.jsx)(i.p,{children:\"This is the most practically useful thing in this piece, and it is a detail we have not seen published anywhere.\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"The ChatGPT desktop app's bundle identifier is \",(0,e.jsx)(i.strong,{children:(0,e.jsx)(i.code,{children:\"com.openai.codex\"})}),\". Not \",(0,e.jsx)(i.code,{children:\"com.openai.chat\"}),\", not \",(0,e.jsx)(i.code,{children:\"com.openai.chatgpt\"}),\". Its application-identifier entitlement reads \",(0,e.jsx)(i.code,{children:\"2DC432GLL2.com.openai.codex\"}),\", and its application groups are named \",(0,e.jsx)(i.code,{children:\"2DC432GLL2.com.openai.codex.notifications\"}),\" and \",(0,e.jsx)(i.code,{children:\"2DC432GLL2.com.openai.sky.CUAService\"}),\".\"]}),`\n`,(0,e.jsx)(i.p,{children:\"Confirm it on your own machine:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"osascript\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -e\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:` 'id of app \"ChatGPT\"'`})]})})})}),`\n`,(0,e.jsx)(i.p,{children:\"Or:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"mdls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -name\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" kMDItemCFBundleIdentifier\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Applications/ChatGPT.app\"})]})})})}),`\n`,(0,e.jsxs)(i.p,{children:[\"Why this matters: \",(0,e.jsx)(i.code,{children:\"tccutil\"}),\" is the only command-line tool for TCC, its only verb is \",(0,e.jsx)(i.code,{children:\"reset\"}),\", and its syntax is:\"]}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"tccutil\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" reset\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" SERVICE\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\" [BUNDLE_ID]\"})]})})})}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"If you omit the bundle identifier, it resets that service for every app on your Mac.\"}),\" Running \",(0,e.jsx)(i.code,{children:\"tccutil reset SystemPolicyAllFiles\"}),\" without an identifier will strip Full Disk Access from your backup software, your disk utility, your antivirus and everything else that had it. That is a genuinely bad afternoon.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"And if you \",(0,e.jsx)(i.em,{children:\"guess\"}),\" the identifier wrong, you get an error rather than a silent no-op \\u2014 \",(0,e.jsx)(i.code,{children:\"tccutil\"}),` validates the bundle identifier before it validates the service name \\u2014 but the failure mode people actually hit is copying a wrong identifier from a blog post and concluding that the reset \"didn't work\". Get it from your own machine.`]}),`\n`,(0,e.jsx)(i.h2,{id:\"the-real-risk-is-composition\",children:\"The Real Risk Is Composition\"}),`\n`,(0,e.jsx)(i.p,{children:\"The most instructive report from launch week is not about the plugin's permissions at all.\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"Writing in PCWorld on 21 August 2026, a reviewer tested the plugin by asking ChatGPT to summarise conversations, draft messages, and then delete some spam threads. Deleting messages is not something the Messages plugin can do. Instead of declining, ChatGPT \",(0,e.jsx)(i.strong,{children:\"fell back to a computer-use capability the author had enabled earlier and forgotten about\"}),\". The author watched screenshots of the actual Messages window appear in the ChatGPT interface while the assistant moved the pointer and clicked Delete on the spam conversations.\"]}),`\n`,(0,e.jsx)(i.p,{children:`The author's own framing is the correct one: ChatGPT \"didn't break out of its bounds.\" Nothing was compromised. Every capability involved had been granted. The problem is that two separately reasonable approvals \\u2014 \"you may read my Messages\" and \"you may control my screen\" \\u2014 combined into a behaviour neither approval described.`}),`\n`,(0,e.jsxs)(i.p,{children:[\"That entitlement we spotted earlier, the application group named \",(0,e.jsx)(i.code,{children:\"2DC432GLL2.com.openai.sky.CUAService\"}),\", is consistent with a computer-use agent service shipping inside the same app bundle. We are not claiming that group is what drove the clicks; we are noting that the capability lives in the same process you are granting Full Disk Access to.\"]}),`\n`,(0,e.jsx)(i.p,{children:'Jonny Evans made the complementary point in Computerworld the same day: the ChatGPT app itself becomes a target. An app holding Full Disk Access is a high-value thing to compromise, because compromising it inherits the grant. And his broader argument is one we would sign: consent that is technically obtained is not the same as consent that is informed. A checkbox that says \"Full Disk Access\" next to an explanation about Messages is technically accurate and practically misleading.'}),`\n`,(0,e.jsxs)(i.p,{children:[\"If you want the wider picture on running AI tools locally with an eye on what they can reach, see our \",(0,e.jsx)(i.a,{href:\"/blog/local-ai-apps-mac-privacy-guide-2026\",children:\"privacy guide to local AI apps on Mac\"}),\".\"]}),`\n`,(0,e.jsx)(i.h2,{id:\"runs-locally-does-not-mean-what-most-people-read-into-it\",children:'\"Runs Locally\" Does Not Mean What Most People Read Into It'}),`\n`,(0,e.jsx)(i.p,{children:\"This phrase is doing a lot of work in the launch coverage, and it is worth taking apart, because it is simultaneously true and easy to misread.\"}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"What runs locally:\"}),\" the file access. The plugin reads \",(0,e.jsx)(i.code,{children:\"chat.db\"}),\" on your Mac. It uses AppleScript and accessibility APIs on your Mac. Your entire message database is not uploaded to OpenAI as a bulk export, and OpenAI says no index of it is built or retained.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"What does not run locally:\"}),\" the model. ChatGPT is a cloud service. When you ask it to summarise a thread, the content of that thread is sent to OpenAI's servers to be summarised, because that is the only place the summarisation can happen. There is no on-device model doing this work.\"]}),`\n`,(0,e.jsxs)(i.p,{children:['So the accurate mental model is not \"your messages stay on your Mac\". It is ',(0,e.jsx)(i.strong,{children:'\"your messages stay on your Mac until you ask a question about them, and then the relevant ones travel.\"'}),\" That is a meaningfully better privacy posture than a background service that continuously uploads and indexes everything \\u2014 genuinely so, and OpenAI deserves credit for building it that way. It is not the same thing as on-device processing.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"This distinction matters because macOS \",(0,e.jsx)(i.em,{children:\"does\"}),\" have on-device processing for some equivalent tasks. Apple Intelligence's summarisation features run on the Neural Engine for a defined set of operations, with Private Cloud Compute for the rest. If your requirement is that message content never leaves the machine under any circumstances, that is a different product category, and our guide to \",(0,e.jsx)(i.a,{href:\"/blog/local-ai-apps-mac-privacy-guide-2026\",children:\"running AI locally on a Mac\"}),` covers what genuinely on-device options look like today. If your requirement is \"do not build a permanent searchable copy of my life on a server\", the plugin's design already meets it.`]}),`\n`,(0,e.jsx)(i.p,{children:\"The related question people ask \\u2014 whether message content is used for training \\u2014 is a ChatGPT account settings question, not a macOS one, and it is governed by whatever data controls apply to your plan. Check those settings directly rather than inferring from the plugin's description.\"}),`\n`,(0,e.jsx)(i.h2,{id:\"if-you-manage-macs-for-an-organisation\",children:\"If You Manage Macs for an Organisation\"}),`\n`,(0,e.jsx)(i.p,{children:\"Everything above is a personal decision. On managed Macs it is a policy decision, and macOS gives you a way to make it before anyone clicks anything.\"}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Full Disk Access can be governed by MDM.\"}),\" The Privacy Preferences Policy Control (PPPC) payload lets you pre-approve, or explicitly deny, specific TCC services for specific applications identified by bundle ID and code requirement. The relevant service for Full Disk Access is \",(0,e.jsx)(i.code,{children:\"SystemPolicyAllFiles\"}),\"; Apple Events automation is \",(0,e.jsx)(i.code,{children:\"AppleEvents\"}),\"; Accessibility is \",(0,e.jsx)(i.code,{children:\"Accessibility\"}),\"; screen capture is \",(0,e.jsx)(i.code,{children:\"ScreenCapture\"}),\".\"]}),`\n`,(0,e.jsx)(i.p,{children:\"Three points worth knowing before you write the profile:\"}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Denying is more reliable than allowing here.\"}),' A PPPC payload that denies a service prevents the user from granting it in System Settings. That is the control you want if the answer is \"no\".']}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Identify the app correctly.\"}),\" The bundle identifier is \",(0,e.jsx)(i.code,{children:\"com.openai.codex\"}),\" and the team identifier is \",(0,e.jsx)(i.code,{children:\"2DC432GLL2\"}),\" on the build we inspected. Your code requirement should pin both \\u2014 a payload keyed on the display name will not do what you want.\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Screen capture and accessibility are the computer-use surface.\"}),\" If your concern is an AI agent driving a managed Mac, denying \",(0,e.jsx)(i.code,{children:\"SystemPolicyAllFiles\"}),\" alone does not address it. \",(0,e.jsx)(i.code,{children:\"Accessibility\"}),\" and \",(0,e.jsx)(i.code,{children:\"ScreenCapture\"}),\" are separate services and need separate entries.\"]}),`\n`]}),`\n`,(0,e.jsxs)(i.p,{children:[\"There is also a data-governance question that sits outside macOS entirely: an approved corporate ChatGPT deployment reading a user's Messages database will pull in personal conversations alongside work ones, because \",(0,e.jsx)(i.code,{children:\"chat.db\"}),\" does not distinguish. That is worth raising with whoever owns your acceptable-use policy before it becomes an incident. Our \",(0,e.jsx)(i.a,{href:\"/blog/macos-tahoe-enterprise-deployment-guide-2025\",children:\"macOS enterprise deployment guide\"}),\" covers the profile mechanics in general.\"]}),`\n`,(0,e.jsx)(i.h2,{id:\"how-to-audit-what-you-have-already-granted\",children:\"How to Audit What You Have Already Granted\"}),`\n`,(0,e.jsx)(i.p,{children:\"Do this whether or not you use the plugin. It takes two minutes and it applies to every app, not just this one.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"1-full-disk-access\",children:\"1. Full Disk Access\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"System Settings \\u2192 Privacy & Security \\u2192 Full Disk Access.\"})}),`\n`,(0,e.jsxs)(i.p,{children:[\"Read the whole list. For each entry, ask one question: \",(0,e.jsx)(i.em,{children:\"does this app need to read every protected file on my Mac in order to do its job?\"}),\" Backup tools genuinely do. Disk-analysis tools genuinely do. Terminal, if you use it for administration, genuinely does. Most other things do not, and apps that were granted it years ago for a one-off reason are still holding it.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"Toggle off anything you cannot justify. Nothing breaks permanently \\u2014 the app will ask again if it needs it.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"2-automation\",children:\"2. Automation\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"System Settings \\u2192 Privacy & Security \\u2192 Automation.\"})}),`\n`,(0,e.jsxs)(i.p,{children:[\"This pane is organised as \",(0,e.jsx)(i.em,{children:\"controller app \\u2192 list of apps it may control\"}),\". Expand ChatGPT and see what is under it. If it lists Messages, that is the plugin. If it lists Finder, System Events, Terminal or Safari, that is a broader automation surface, and you should know why it is there.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"3-accessibility\",children:\"3. Accessibility\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"System Settings \\u2192 Privacy & Security \\u2192 Accessibility.\"})}),`\n`,(0,e.jsx)(i.p,{children:\"This is the permission behind synthetic clicks and keystrokes \\u2014 the mechanism a computer-use feature needs. If an app is in this list, it can drive your Mac's interface. Check whether ChatGPT is there, and remove it if you do not want that capability sitting armed.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"4-screen--system-audio-recording\",children:\"4. Screen & System Audio Recording\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.strong,{children:\"System Settings \\u2192 Privacy & Security \\u2192 Screen & System Audio Recording.\"})}),`\n`,(0,e.jsx)(i.p,{children:\"A computer-use agent needs to see the screen to act on it. If ChatGPT is in this list, that is what the screenshots in the PCWorld account came from.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.img,{alt:\"Auditing app permissions on macOS\",src:\"/images/blog/chatgpt-apple-messages-plugin-mac-full-disk-access-privacy-2026/content-2.webp\",width:\"1024\",height:\"572\"})}),`\n`,(0,e.jsx)(i.h3,{id:\"5-verify-from-terminal\",children:\"5. Verify From Terminal\"}),`\n`,(0,e.jsx)(i.p,{children:\"Permissions panes can lie to you \\u2014 an app can appear granted in System Settings while the grant is broken, usually because the app's code signature changed. The reliable check is behavioural. After revoking Full Disk Access from an app, quit the app completely, relaunch it, and ask it to do the thing that needs the permission. If it prompts you again, the revocation took.\"}),`\n`,(0,e.jsx)(i.p,{children:\"You can also confirm the boundary generically from a Terminal without Full Disk Access:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ~/Library/Messages/\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" 2>&1\"})]})})})}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.code,{children:\"Operation not permitted\"}),\" means TCC is doing its job for that process.\"]}),`\n`,(0,e.jsx)(i.h2,{id:\"if-you-want-to-use-the-plugin-anyway\",children:\"If You Want to Use the Plugin Anyway\"}),`\n`,(0,e.jsx)(i.p,{children:'This is a legitimate choice, and there is a middle position between \"grant everything\" and \"never touch it\".'}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Do keep send approval on.\"}),\" Do not enable persistent approval for a conversation, even one you send to constantly. OpenAI told you why.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Do check whether computer use is enabled, separately.\"}),\" It is a different feature with a different switch. If you do not need an AI moving your pointer, turn it off, and remove the app from Accessibility and Screen Recording.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Do treat Full Disk Access as revocable, not permanent.\"}),\" If you use the Messages plugin occasionally, there is nothing stopping you from toggling Full Disk Access off between sessions. It is one switch. The plugin will stop working and will work again when you toggle it back.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Do consider which Mac.\"}),\" If you have more than one, the plugin does not have to live on the one with your work Mail store, your password vault's backup, and eight years of Time Machine snapshots.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Do think about the other side of the conversation.\"}),\" Everyone who has ever texted you is in that database, and they did not consent to anything. That is not a macOS problem and no permission setting addresses it. It is worth a moment's thought anyway.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Do not grant Full Disk Access to an app you did not download yourself, from a source you trust.\"}),\" An installer that asks for Full Disk Access with an unclear justification is the single highest-leverage request malware can make on macOS, and it is exactly the pattern behind the credential-stealing families we covered in \",(0,e.jsx)(i.a,{href:\"/blog/fake-mac-crash-report-password-prompt-crashstealer-malware-protection-2026\",children:\"the fake crash report password prompt\"}),\".\"]}),`\n`,(0,e.jsx)(i.h2,{id:\"troubleshooting-common-issues\",children:\"Troubleshooting Common Issues\"}),`\n`,(0,e.jsx)(i.h3,{id:\"the-plugin-does-not-appear-in-the-plugins-tab\",children:\"The plugin does not appear in the Plugins tab\"}),`\n`,(0,e.jsx)(i.p,{children:\"Check three things in order. First, you are on an Apple silicon Mac \\u2014 the plugin is not offered on Intel. Second, the ChatGPT desktop app is current; features arriving in an August build will not appear in a build from spring. Third, you are in the ChatGPT desktop app, not the web app in a browser \\u2014 a browser tab cannot hold macOS privacy permissions.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"i-granted-full-disk-access-but-chatgpt-still-cannot-read-messages\",children:\"I granted Full Disk Access but ChatGPT still cannot read Messages\"}),`\n`,(0,e.jsx)(i.p,{children:\"Quit ChatGPT completely \\u2014 Command-Q, not just closing the window \\u2014 and relaunch it. TCC grants are evaluated when a process starts. A running process that was denied stays denied for its lifetime.\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"If that does not fix it, you may be hitting the code-signing identity problem: if the app was updated or moved after the grant, the entry in System Settings can look correct while pointing at a different signature. Toggle the app off in Full Disk Access, remove it with the minus button, quit, relaunch, and add it again. Our \",(0,e.jsx)(i.a,{href:\"/blog/mac-screen-recording-full-disk-access-permission-keeps-asking-fix-2026\",children:\"TCC troubleshooting guide\"}),\" covers the five distinct causes of a permission that reads as granted but does not work.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"chatgpt-keeps-asking-to-control-messages-every-time\",children:\"ChatGPT keeps asking to control Messages every time\"}),`\n`,(0,e.jsx)(i.p,{children:\"That is the Automation permission not sticking, and the cause is almost always the same code-signing identity issue. Check System Settings \\u2192 Privacy & Security \\u2192 Automation, expand ChatGPT, and confirm Messages is toggled on. If it is on and it still asks, reset just that pairing:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"tccutil\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" reset\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" AppleEvents\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" com.openai.codex\"})]})})})}),`\n`,(0,e.jsx)(i.p,{children:\"Then approve the prompt once more. Note the bundle identifier \\u2014 see the section above on why guessing it is a bad idea.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"i-want-to-remove-every-permission-i-gave-it\",children:\"I want to remove every permission I gave it\"}),`\n`,(0,e.jsx)(i.p,{children:\"The complete reset, using the correct bundle identifier:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"tccutil\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" reset\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" All\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" com.openai.codex\"})]})})})}),`\n`,(0,e.jsxs)(i.p,{children:[\"This clears every TCC grant for that app only. Quit and relaunch ChatGPT afterwards. Then confirm in System Settings that Full Disk Access, Automation, Accessibility and Screen Recording no longer list it. \",(0,e.jsx)(i.code,{children:\"tccutil\"}),\" cannot \",(0,e.jsx)(i.em,{children:\"grant\"}),\" anything, only reset, so there is no way to undo this from Terminal \\u2014 you will re-approve through the normal dialogs.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"messages-sent-that-i-did-not-approve\",children:\"Messages sent that I did not approve\"}),`\n`,(0,e.jsx)(i.p,{children:\"Check whether persistent approval was enabled for that conversation. In the ChatGPT interface, the per-conversation setting that skips confirmation is the thing to look for. Turn it off. If you cannot find a setting that explains it, revoke Automation for Messages \\u2014 that removes the send path entirely while leaving reading intact, which is a reasonable configuration if you only want summarisation.\"}),`\n`,(0,e.jsx)(i.h2,{id:\"faq\",children:\"FAQ\"}),`\n`,(0,e.jsx)(i.h3,{id:\"does-chatgpt-upload-my-messages-to-openais-servers\",children:\"Does ChatGPT upload my Messages to OpenAI's servers?\"}),`\n`,(0,e.jsx)(i.p,{children:`OpenAI says the plugin runs locally on your Mac and does not build an index of your texts. What is sent to the model is the context you prompt it to use \\u2014 if you ask it to summarise a thread, that thread's content goes to the model to be summarised, because that is how a cloud model works. \"Runs locally\" describes where the file access happens, not where the reasoning happens. If you need message content never to leave the machine, this feature is not that.`}),`\n`,(0,e.jsx)(i.h3,{id:\"is-full-disk-access-really-necessary-just-to-read-messages\",children:\"Is Full Disk Access really necessary just to read Messages?\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"Yes, given how Apple built it. \",(0,e.jsx)(i.code,{children:\"~/Library/Messages/\"}),` sits behind the Full Disk Access gate and there is no narrower \"Messages access\" permission for third-party apps to request. Apple provides scoped prompts for Desktop, Documents, Downloads, iCloud Drive and removable volumes, but not for the Messages store. So an app that wants to read your messages must ask for the broad permission. The design limitation is Apple's; the consequence is yours.`]}),`\n`,(0,e.jsx)(i.h3,{id:\"what-is-the-chatgpt-apps-bundle-identifier\",children:\"What is the ChatGPT app's bundle identifier?\"}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.code,{children:\"com.openai.codex\"}),\", on the build we inspected (version 26.727.40816, 22 August 2026), signed by OpenAI OpCo, LLC with Team ID \",(0,e.jsx)(i.code,{children:\"2DC432GLL2\"}),\". Verify on your own Mac with \",(0,e.jsx)(i.code,{children:`osascript -e 'id of app \"ChatGPT\"'`}),\" before using it in any \",(0,e.jsx)(i.code,{children:\"tccutil\"}),\" command.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"is-the-chatgpt-mac-app-sandboxed\",children:\"Is the ChatGPT Mac app sandboxed?\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"No. Its entitlements set \",(0,e.jsx)(i.code,{children:\"com.apple.security.app-sandbox\"}),\" to \",(0,e.jsx)(i.code,{children:\"false\"}),\". It is a Developer ID\\u2013signed app distributed outside the Mac App Store, where sandboxing is not required. Combined with Full Disk Access, that means very few remaining file-level restrictions.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"can-chatgpt-delete-my-messages\",children:\"Can ChatGPT delete my messages?\"}),`\n`,(0,e.jsx)(i.p,{children:\"The Messages plugin's documented capabilities are read, search, draft and send. Deletion is not among them. However, the PCWorld hands-on found that when asked to delete, ChatGPT used a separately-enabled computer-use capability to click the Delete buttons in the Messages interface instead. If you have not enabled computer use, that path does not exist. If you have, it does.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"does-this-work-on-an-intel-mac\",children:\"Does this work on an Intel Mac?\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"No. The plugin is Apple silicon only. If you are still on Intel and weighing your options, our \",(0,e.jsx)(i.a,{href:\"/blog/macos-27-end-of-intel-mac-era-final-compatibility-list-2026\",children:\"end of the Intel Mac era guide\"}),\" covers the wider picture.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"should-i-use-it\",children:\"Should I use it?\"}),`\n`,(0,e.jsx)(i.p,{children:\"That depends on what is on your Mac and what you get out of it. The honest framing is: you are granting an unsandboxed, network-connected, cloud-backed application permanent read access to every protected file on the machine, in exchange for message summarisation and drafting. If that trade is worth it to you, take the mitigations in this article \\u2014 keep send approval on, keep computer use off unless you want it, and revoke the permission when you are not using the feature. If it is not, you lose nothing but a convenience.\"}),`\n`,(0,e.jsx)(i.h2,{id:\"conclusion\",children:\"Conclusion\"}),`\n`,(0,e.jsx)(i.p,{children:\"There is a version of this article that is a scare piece, and this is not it. OpenAI built the feature in a defensible way: it runs on-device for the file access, it does not persist an index, it gates sending behind explicit approval by default, and it tells you not to turn that gate off. Those are better choices than the alternatives.\"}),`\n`,(0,e.jsx)(i.p,{children:'The problem is upstream of OpenAI. macOS has no permission that means \"you may read Messages\". It has one that means \"you may read everything\", and any app that wants the first has to ask for the second. Users then approve the broad permission while reading an explanation about the narrow one \\u2014 which is exactly the informed-consent gap Computerworld identified, and exactly the gap Apple could close by adding a scoped Messages service to TCC the way it did for Contacts, Calendars and Photos.'}),`\n`,(0,e.jsx)(i.p,{children:\"Until that happens, the burden is on you to know what the switch does. Now you do. Go and look at your Full Disk Access list \\u2014 not because of ChatGPT, but because you will almost certainly find something in there you granted in 2023 and forgot about.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsxs)(i.em,{children:[\"Related reading: \",(0,e.jsx)(i.a,{href:\"/blog/mac-screen-recording-full-disk-access-permission-keeps-asking-fix-2026\",children:\"Why your Mac keeps asking for permission: how TCC really works\"}),\" \\xB7 \",(0,e.jsx)(i.a,{href:\"/blog/local-ai-apps-mac-privacy-guide-2026\",children:\"Local AI apps on Mac: a privacy guide\"}),\" \\xB7 \",(0,e.jsx)(i.a,{href:\"/blog/mac-security-privacy-guide-2026\",children:\"Mac security and privacy guide 2026\"}),\" \\xB7 \",(0,e.jsx)(i.a,{href:\"/blog/macos-tahoe-chatgpt-integration-complete-guide-2025\",children:\"ChatGPT integration in macOS Tahoe\"}),\" \\xB7 \",(0,e.jsx)(i.a,{href:\"/blog/icloud-private-relay-leaking-real-ip-address-passkeys-webkit-mac-2026\",children:\"iCloud Private Relay is leaking your real IP address\"})]})}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Sources:\"}),' 9to5Mac, \"ChatGPT update adds Apple Messages integration on Mac\", 20 August 2026 \\xB7 Computerworld, Jonny Evans, \"ChatGPT wants Full Disk Access to your Mac and Messages\", 21 August 2026 \\xB7 PCWorld, \"I gave ChatGPT access to Apple Messages. Then it took control of my Mac\", 21 August 2026 \\xB7 Engadget, \"ChatGPT on Mac can now read and respond to Apple iMessages\", August 2026 \\xB7 Apple, \"Controlling app access to files in macOS\", Apple Platform Security \\xB7 Local verification on macOS 26.5.2 (build 25F84) and ChatGPT.app 26.727.40816, 22 August 2026, using ',(0,e.jsx)(i.code,{children:\"codesign\"}),\", \",(0,e.jsx)(i.code,{children:\"plutil\"}),\" and \",(0,e.jsx)(i.code,{children:\"ls\"}),\".\"]})]})}function d(n={}){let{wrapper:i}=n.components||{};return i?(0,e.jsx)(i,{...n,children:(0,e.jsx)(c,{...n})}):c(n)}return v(w);})();\n;return Component;","toc":[{"title":"Key Takeaways","url":"#key-takeaways","depth":2},{"title":"What OpenAI Shipped","url":"#what-openai-shipped","depth":2},{"title":"The Three Permissions, and What Each One Really Does","url":"#the-three-permissions-and-what-each-one-really-does","depth":2},{"title":"Contacts: Narrow and Well-Behaved","url":"#contacts-narrow-and-well-behaved","depth":3},{"title":"Automation: The Send Path","url":"#automation-the-send-path","depth":3},{"title":"Full Disk Access: The One That Is Not Scoped","url":"#full-disk-access-the-one-that-is-not-scoped","depth":3},{"title":"And It Is Not Sandboxed","url":"#and-it-is-not-sandboxed","depth":3},{"title":"The Bundle ID Trap","url":"#the-bundle-id-trap","depth":2},{"title":"The Real Risk Is Composition","url":"#the-real-risk-is-composition","depth":2},{"title":"\"Runs Locally\" Does Not Mean What Most People Read Into It","url":"#runs-locally-does-not-mean-what-most-people-read-into-it","depth":2},{"title":"If You Manage Macs for an Organisation","url":"#if-you-manage-macs-for-an-organisation","depth":2},{"title":"How to Audit What You Have Already Granted","url":"#how-to-audit-what-you-have-already-granted","depth":2},{"title":"1. Full Disk Access","url":"#1-full-disk-access","depth":3},{"title":"2. Automation","url":"#2-automation","depth":3},{"title":"3. Accessibility","url":"#3-accessibility","depth":3},{"title":"4. Screen & System Audio Recording","url":"#4-screen--system-audio-recording","depth":3},{"title":"5. Verify From Terminal","url":"#5-verify-from-terminal","depth":3},{"title":"If You Want to Use the Plugin Anyway","url":"#if-you-want-to-use-the-plugin-anyway","depth":2},{"title":"Troubleshooting Common Issues","url":"#troubleshooting-common-issues","depth":2},{"title":"The plugin does not appear in the Plugins tab","url":"#the-plugin-does-not-appear-in-the-plugins-tab","depth":3},{"title":"I granted Full Disk Access but ChatGPT still cannot read Messages","url":"#i-granted-full-disk-access-but-chatgpt-still-cannot-read-messages","depth":3},{"title":"ChatGPT keeps asking to control Messages every time","url":"#chatgpt-keeps-asking-to-control-messages-every-time","depth":3},{"title":"I want to remove every permission I gave it","url":"#i-want-to-remove-every-permission-i-gave-it","depth":3},{"title":"Messages sent that I did not approve","url":"#messages-sent-that-i-did-not-approve","depth":3},{"title":"FAQ","url":"#faq","depth":2},{"title":"Does ChatGPT upload my Messages to OpenAI's servers?","url":"#does-chatgpt-upload-my-messages-to-openais-servers","depth":3},{"title":"Is Full Disk Access really necessary just to read Messages?","url":"#is-full-disk-access-really-necessary-just-to-read-messages","depth":3},{"title":"What is the ChatGPT app's bundle identifier?","url":"#what-is-the-chatgpt-apps-bundle-identifier","depth":3},{"title":"Is the ChatGPT Mac app sandboxed?","url":"#is-the-chatgpt-mac-app-sandboxed","depth":3},{"title":"Can ChatGPT delete my messages?","url":"#can-chatgpt-delete-my-messages","depth":3},{"title":"Does this work on an Intel Mac?","url":"#does-this-work-on-an-intel-mac","depth":3},{"title":"Should I use it?","url":"#should-i-use-it","depth":3},{"title":"Conclusion","url":"#conclusion","depth":2}],"estimatedTime":24}