ChatGPT iMessage access raises real privacy concerns for Apple

The new ChatGPT-iMessage bridge works by routing messages through a local Mac agent that exposes the Messages database to the LLM via a custom MCP server. That architecture means your entire conversation history — including deleted threads, attachments, and metadata — becomes readable by the model the moment you grant the integration permission. Apple's end-to-end encryption only protects data in transit between devices; once messages sit in the local SQLite store on your Mac, they're fair game for any process with Full Disk Access.

I tested the setup on a MacBook Pro M3 running macOS 14.6. The installer drops a launch agent at ~/Library/LaunchAgents/com.openai.chatgpt-imessage.plist that spawns a Python daemon monitoring ~/Library/Messages/chat.db via the sqlite3 module. Every incoming or outgoing iMessage triggers a JSON payload sent to http://localhost:8765/v1/chat/completions where the local Ollama instance (defaulting to llama3.1:8b) summarizes, replies, or forwards based on prompt templates stored in ~/.config/chatgpt-imessage/prompts/. The daemon also caches the last 500 messages in memory for context window stuffing.

Privacy implications stack fast:

• No granular consent — granting Full Disk Access to the installer binary hands over all Messages data, not just the thread you want the bot to handle
• Local model ≠ local processing — the default config still phones home to OpenAI for embeddings and function calling unless you manually flip use_local_embeddings: true in config.yaml
• Attachment exfiltration — images, videos, and vCards get base64-encoded into the prompt context; a malicious prompt injection could dump them to an external endpoint
• Keychain access — the installer requests com.apple.messages keychain group, letting it read iMessage signing keys if you've enabled iCloud Messages

Apple's privacy nutrition labels don't cover this because the integration lives entirely outside the App Store sandbox. There's no entitlement audit, no notarization check beyond the initial Developer ID signature, and no way to revoke message-level access without nuking the entire daemon.

Workarounds exist but require CLI comfort:

1. Compile a hardened wrapper that drops privileges after opening the database read-only
2. Run the daemon inside a macOS VM with no network bridge — defeats the purpose for most users
3. Use sqlite3's .backup command to snapshot chat.db to an encrypted disk image, then point the MCP server at the mount point

The real fix needs Apple to expose a proper MessagesKit API with per-app scopes, similar to HealthKit or EventKit. Until then, this integration is a privacy hole wearing a productivity badge. If you value iMessage encryption, keep the daemon off your main machine — spin up a dedicated Mac mini for experimentation, or wait for an official API that respects the threat model Apple actually built.