ChatGPT's Message Scanning Feature Raises Security Concerns
New plugin makes personal messages searchable without all participants' consent
1What the New ChatGPT Plugin Does
OpenAI's new plugin for Mac users enables ChatGPT to search, summarize, and draft replies for iMessage, SMS, and RCS conversations. Users must install the plugin and grant permissions including AppleScript, Accessibility, and Full Disk Access. However, one person activating the plugin exposes their entire message history - including messages from non-consenting participants - to AI access.
2Security Experts' Concerns
Security expert Paul Walsh calls this integration 'one of the most dangerous things I've seen in technology.' Concerns focus on how one person enabling the plugin makes all their encrypted messages - including those from people who never consented - searchable by ChatGPT. Walsh describes this as a risk that could function like 'spyware.'
3Limitations of Encryption
Experts note Apple's end-to-end encryption doesn't protect messages after they reach devices. Lookout CTO Dave Richardson states we lose many encryption advantages by granting third-party access. When messages can be read before encryption or after decryption, fundamental security concepts are violated.
4OpenAI's Defense
OpenAI states the plugin runs locally by default and only reads Messages when explicitly requested. The company claims user message history isn't automatically uploaded or indexed. However, choosing to store a conversation in the cloud means message content could be stored on company servers.
5Proton's Warnings
Privacy-focused Proton warned the plugin could affect not just users but everyone they communicate with. They highlighted how Full Disk Access permission might create vulnerabilities. Proton emphasized that even people who never use ChatGPT could have their messages exposed if someone they chat with enables the plugin.
6Legal and Ethical Issues
Experts note storing encrypted conversation content on another company's servers creates potential access points for hackers, insiders, governments, or law enforcement. Walsh describes this as an 'encryption backdoor.' This intensifies tensions between digital privacy rights and tech companies' desire to offer innovative features.
7Risks for Users
A user enabling the plugin exposes years of private conversations to ChatGPT's search capability. This poses serious risks for those using encrypted messaging for sensitive topics. Experts stress users must fully understand permission scopes and potential consequences before enabling such features.
8The Future of Digital Privacy
This development reignited digital privacy debates as AI assistants access increasingly personal data. Tech companies face growing pressure to balance innovative features with user privacy. Experts argue for urgent strengthening of consent mechanisms and transparency standards in the industry.