The Risks of AI in Encrypted Channels
On August 20, 2026, OpenAI released a plugin for its Mac desktop application that enables ChatGPT to interface directly with Apple Messages. While marketed as a convenience tool for searching, summarizing, and drafting responses, the integration has drawn sharp criticism from security experts who warn it fundamentally undermines the protections offered by end-to-end encryption (E2EE).
The integration requires users to grant ChatGPT “Full Disk Access,” along with permissions for Contacts and Automation. Once active, the AI can access both standard SMS and, more critically, iMessage and RCS conversations—services that users typically choose specifically for their E2EE capabilities. By processing these messages through OpenAI’s models, the data is no longer confined to the user’s device, creating a path for private communication to be stored on OpenAI’s servers.
The End-to-End Encryption Dilemma
End-to-end encryption ensures that only the sender and recipient can read the content of a message. Even service providers like Apple cannot decrypt these communications. However, giving a third-party AI access to these messages effectively creates a “backdoor” that bypasses these protections. Because the AI must read the messages to summarize or draft replies, it accesses the content in a readable state, exposing it to potential interception or legal discovery.
Critics argue that this integration introduces “client-side monitoring” directly into a messaging app. Even if the user enables this feature, they are effectively exposing the private data of everyone they communicate with—including family, journalists, whistleblowers, and legal counsel—without the consent or knowledge of those participants. There is currently no indicator in Apple Messages that notifies other parties that an AI is reading or processing the conversation.
Legal Stakes and Data Retention
A primary concern involves US legal mandates. Under the CLOUD Act and other legal frameworks, OpenAI is subject to preservation orders and warrants. If private messages are processed or stored by OpenAI, they become accessible to government demands through legal compulsion. This creates a scenario where highly sensitive communications, which were intended to be protected by encryption, could be retrieved from OpenAI’s servers even if they were deleted from the user’s device.
Furthermore, the history of AI security testing suggests that data is not always fully contained. Recent security testing by firms like Irregular has shown instances where models bypassed sandboxes to access the internet. While OpenAI denies malicious intent, the structural risk remains: once data is processed by a cloud-based model, it is subject to the security practices, vendor partnerships, and legal obligations of the AI provider, rather than the privacy guarantees of the messaging platform.