ChatGPT Can Send iMessages Now. It Still Cannot Run Outbound.

What OpenAI shipped on 20 August#

OpenAI released an Apple Messages plugin for the ChatGPT desktop app on macOS on 20 August 2026. The plugin reads and searches the chats already on that Mac and sends new ones through the Messages app.

Coverage framed it as ChatGPT gaining control of iMessage. Apple published no API and announced nothing, and the plugin was not part of any joint launch (thenextweb.com, seen 27 August 2026).

For a sales team the interesting question is narrower than the headlines. Not whether a chatbot can text, but whether this changes how outbound gets run.

• Availability is the macOS desktop app, usable in ChatGPT Work and Codex, reading iMessage, SMS and RCS chats stored on that Mac (9to5mac.com, seen 27 August 2026).
• The iPhone app does not have it. Neither does the web app (usatoday.com, seen 27 August 2026).
• Setup asks for Full Disk Access, access to contact names, and automation rights over the Messages app in macOS System Settings (engadget.com, seen 27 August 2026).
• Sending is approval-gated by default, and OpenAI says it expects people to keep it that way (techcrunch.com, seen 27 August 2026).

Any sending system answers three questions#

Outbound at team scale rests on three answers: who the sender is, who authorizes each send, and where the reply lands. Every platform in this category is really a set of answers to those three.

The plugin answers all three, coherently, for one person managing one inbox. Read the same answers as a sales operation and the gaps are structural rather than a matter of missing features.

• None of those gaps is a bug. The plugin was built to help one person handle their own messages, and it does that job.
• A team running outreach needs the three answers to hold when the person is asleep, on a call, or no longer at the company.

Approval is the ceiling, and it is deliberate#

Per-message approval decides the question. OpenAI discourages persistent approval, which it says removes your final chance to review a message before ChatGPT sends it as you (techcrunch.com, seen 27 August 2026).

Read that as a throughput number and the ceiling is a person's attention, not a rate limit. A rep who can review two hundred drafts in a sitting has done a full day of work and produced a day of sends.

Outbound economics do not come from typing speed. They come from consistent daily volume, a reply rate that holds, and the conversion that follows, running whether or not anyone is at the keyboard.

• Approval per message is a genuinely good design for a personal inbox, where a wrong send costs a relationship.
• The same design makes campaign sending, scheduled follow-up and speed to lead impossible to run unattended.
• Speed to lead is the clearest casualty: a lead that fills a form at 9pm gets answered when somebody opens a laptop.

One Apple ID is one reputation to lose#

Sending happens from the Apple ID signed in on that Mac, so every message goes out as that person from their own number. Recipients see a colleague, not a company line.

Consolidating a whole outreach program onto one personal identity concentrates risk. A block, a spam report or a compromised laptop hits the number a rep also uses for family and existing clients.

Separation is the whole reason business lines exist. A line that carries only business conversations can be paced, monitored, paused and replaced without touching anybody's personal messaging.

• Handover is the other half. When a rep leaves, their conversation history leaves on their Apple ID and their Mac.
• Attribution suffers too. A number that mixes personal and prospect threads cannot report reply rate on a campaign without somebody reading the whole inbox.

Full Disk Access is a security review, not a checkbox#

Full Disk Access lets the plugin read the local Messages database, which sits decrypted on the machine. Encryption does not protect that archive from software the user authorized (thenextweb.com, seen 27 August 2026).

On a personal laptop that is a personal decision. On a company Mac holding client threads, it is a data question with a name on it, and most security reviews will want to see the answer written down.

Contact access widens the same question. The setup flow asks for contact names alongside message history, so the grant covers who a person knows as well as what they said.

• OpenAI has said the plugin runs locally on the Mac and that it does not store the messages (cnet.com, seen 27 August 2026).
• Local processing answers the storage question, not the access question. Anything with Full Disk Access can read the archive.
• A regulated book of business makes this heavier, because the archive holds client identities as well as message content.

OpenAI's own policies rule out the campaign#

OpenAI's Usage Policies prohibit deceit, fraud, scams, spam and impersonation (openai.com/policies/usage-policies, read 27 August 2026). Unsolicited bulk texting sits inside that line, on any channel.

The same policy bars automation of high-stakes decisions in sensitive areas without human review, and it names insurance, employment, financial activities and credit, housing, legal and medical.

Those are the verticals where a large share of B2B texting happens. A mortgage or insurance operation reading that list finds human review written into the terms of the tool it was about to automate.

• That policy set was last revised on 29 October 2025 per its own changelog, so it predates the plugin and applies across every OpenAI product.
• Consent law is separate and applies regardless. The TCPA governs the message, not the software that composed it.
• A tool's usage policy is enforceable against your account. Losing access mid-quarter is a business risk, not a technicality.
• The honest reading: OpenAI built an assistant for conversations you are already having, and wrote policies that say so.

What the volume actually looks like at agent scale#

Published numbers make the scale gap concrete. Blooio's AgentPhone case study claims 340,000 messages delivered at a 98.07% rate to more than 26,000 recipients (blooio.com/case-studies/agentphone, seen 27 August 2026).

Whatever weight you give a vendor's own case study, the order of magnitude is the point. Volumes like that are produced by infrastructure with programmatic sending, not by a person approving drafts on a laptop.

A team comparing the two is not comparing products. One is an assistant for the messages already in front of you, the other is a system for conversations that have not started yet.

• The same case study reports one peak month above 130,000 messages and a reply rate near 44%, on a product whose whole job is agent conversations.
• Per-message human approval and six-figure monthly volume cannot both be true in the same setup.
• Pick the constraint that matters for the job in front of you, then pick a tool built around it.

Where the plugin genuinely earns its place#

Dismissing the release would be the wrong call. Reading a week of missed threads, drafting a reply to a warm conversation and pulling a date out of a long thread are real jobs, and the plugin does them well.

Account executives with a busy personal inbox get the most out of it, because triage is exactly the shape of work it was built for. Nothing about that overlaps with running a sequence to a cold list.

Treating it as an inbox assistant rather than a sending system keeps the security question small and the expectations honest.

• Good fit: catching up on unread threads, drafting replies you will read before they go, finding a detail buried in message history.
• Poor fit: cold outreach, scheduled follow-up, speed to lead, shared team inboxes, opt-out records, and any volume a person cannot personally approve.
• The category question stays where it was. Outbound needs line identity, unattended sending and a record, and none of the three arrived on 20 August.

Frequently asked questions