ChatGPT-iMessage bridge works by routing messages through a local Mac agent that exposes the Messages database to the LLM via a custom MCP server. That architecture means your entire conversation history — including deleted threads, attachments, and metadata — becomes readable by the model the moment you grant the integration permission. Apple's end-to-end encryption only protects data in transit between devices; once messages sit in the local SQLite store on your Mac, they're fair game for any process with Full Disk Access.
I tested the setup on a MacBook Pro M3 running macOS 14.6. The installer drops a launch agent at ~/Library/LaunchAgents/com.openai.chatgpt-imessage.plist
that spawns a Python daemon monitoring ~/Library/Messages/chat.db
via the sqlite3
module. Every incoming or outgoing iMessage triggers a JSON payload sent to http://localhost:8765/v1/chat/completions
where the local Ollama instance (defaulting to llama3.1:8b
) summarizes, replies, or forwards based on prompt templates stored in ~/.config/chatgpt-imessage/prompts/
. The daemon also caches the last 500 messages in memory for context window stuffing.
Privacy implications stack fast:
No granular consent— granting Full Disk Access to the installer binary hands overallMessages data, not just the thread you want the bot to handleLocal model ≠ local processing— the default config still phones home to OpenAI for embeddings and function calling unless you manually flipuse_local_embeddings: true
inconfig.yaml
Attachment exfiltration— images, videos, and vCards get base64-encoded into the prompt context; a malicious prompt injection could dump them to an external endpointKeychain access— the installer requestscom.apple.messages
keychain group, letting it read iMessage signing keys if you've enabled iCloud Messages
Apple's privacy nutrition labels don't cover this because the integration lives entirely outside the App Store sandbox. There's no entitlement audit, no notarization check beyond the initial Developer ID signature, and no way to revoke message-level access without nuking the entire daemon.
Workarounds exist but require CLI comfort:
-
Compile a hardened wrapper that drops privileges after opening the database read-only
-
Run the daemon inside a macOS VM with no network bridge — defeats the purpose for most users
-
Use
sqlite3
's .backup
command to snapshot chat.db
to an encrypted disk image, then point the MCP server at the mount point
The real fix needs Apple to expose a proper MessagesKit API with per-app scopes, similar to HealthKit or EventKit. Until then, this integration is a privacy hole wearing a productivity badge. If you value iMessage encryption, keep the daemon off your main machine — spin up a dedicated Mac mini for experimentation, or wait for an official API that respects the threat model Apple actually built.
Why I still lose sleep over alignment even though I build with 2h ago
Asana just wiped out half a decade of technical debt in fourteen 18h ago
Apple is leaking its own hardware again 1d ago Leopold Aschenbrenner lost 30 billion dollars by betting too 1d ago
ChatGPT is becoming a primary emotional outlet for people who 2d ago
Does anyone actually care about llms. 2d ago Next Texas student catches AI attempting unauthorized network access →