The AI Didn't Break Your Encryption. It Became a New Endpoint.
The claim going around
When OpenAI shipped an Apple Messages plugin for the ChatGPT desktop app on August 20, the sharpest version of the reaction was that OpenAI had killed end-to-end encryption for Apple. It's a good line. It's also wrong — and the way it's wrong matters, because the real story is worse than a broken cipher and won't be fixed by a better one.
No cryptography was attacked. iMessage's end-to-end encryption still does exactly what it claims: it protects your messages in transit and at rest on Apple's servers, with the decryption keys living only on the sender's and recipient's own devices. Apple's own security documentation is blunt about the guarantee — message content is "secured with end-to-end encryption so that no one but the sender and receiver can access them," and "Apple can't decrypt the data." That guarantee holds in full with Advanced Data Protection enabled; in the default configuration, an iCloud Backup escrows a copy of the message key that Apple can reach, so the strongest form of the promise is the one you opt into. Either way, the PQ3 protocol underneath iMessage, with its post-quantum rekeying and machine-checked proofs, is untouched. Nobody defeated it.
So the viral claim is imprecise. But it's pointing at something real, and dismissing it as "just wrong" misses the point as badly as repeating it.
What actually happened
End-to-end encryption is a promise about the space between two endpoints. It says nothing about what happens to a message after a legitimate endpoint decrypts it — because it can't. The whole point is that your device holds the keys.
And your Mac, having received a message, does the only thing it can: it decrypts it and writes the plaintext to a local database, ~/Library/Messages/chat.db. That file is not encrypted with your iMessage keys. It's sitting on your disk in the clear, the way it has to be for the Messages app to show you your conversations.
The ChatGPT plugin reads that file. To do so it needs Full Disk Access — a broad macOS permission the user grants in System Settings — plus Contacts and Automation, because there is no official Apple API for this; it drives Messages through AppleScript and the accessibility layer. Full Disk Access is all-or-nothing: the same grant that lets ChatGPT read your texts also exposes Mail, Safari data, and Time Machine backups. As one analysis put it, "the plugin runs locally, but local read access during a session is still full read access."
Here's the part the "runs locally" framing quietly sidesteps. OpenAI says the plugin runs on the Mac, doesn't build a persistent index, and that message content is "stored locally on a user's computer and is not saved to the company's servers." Read carefully, those are claims about file access and storage — not about inference. ChatGPT Work and Codex, where this plugin lives, have no on-device language model — inference runs on OpenAI's servers, even where a code agent executes locally on your Mac. The message content you select for a request has to go somewhere to be reasoned over, and there is no local model to reason over it. OpenAI has not directly answered what message text reaches its network during a request; reporters noted the plugin "does not fully explain which message content, if any, may reach OpenAI's network while a request is processed." We won't claim more than that. But "stored locally" is not "never transmitted," and the distinction is the entire ballgame.
The encryption held. The endpoint leaked — because you authorized a program on it that forwards decrypted content to a third party.
This is exactly what was warned about
None of this is a surprise. In March 2025, Signal president Meredith Whittaker described the mechanism a year and a half before it shipped, on a SXSW panel. An AI agent that acts across your apps, she said, "would need to be able to drive that [process] across our entire system with something that looks like root permission, accessing every single one of those databases — probably in the clear, because there's no model to do that encrypted."
In the clear. That is chat.db, described before the fact. She named the structural cost, too: agents threaten "to break the blood-brain barrier between the application layer and the OS layer by conjoining all of these separate services [and] muddying their data." The convenience is real — "we can just put our brain in a jar because the thing is doing that and we don't have to touch it" — and so is the price. And where does the thinking happen? "There's no way that's happening on device," she said. "That's almost certainly being sent to a cloud server where it's being processed and sent back."
Proton's CEO Andy Yen has made the constructive half of the argument: "Privacy in the AI era is possible." His position — that useful AI can run on your own phone and laptop rather than shipping your life to someone else's servers — is the design brief the industry keeps declining to accept.
The pattern, not the plugin
Strip the branding away and the shape is generic. A convenience feature reads the most intimate record you keep — who you talk to, when, about what — and to be useful at cloud scale, it moves the plaintext to a company's servers. Once it lands there, it lives under that company's retention terms and within reach of legal process: subpoenas, warrants, and, through cross-border mechanisms, requests from other governments. This is not a flaw in one plugin. It's the default consequence of putting a cloud model between you and your own data. Data that never leaves your machine can still be compelled — but from you, with a device seizure, not quietly from a third party who happens to be holding a copy.
The encryption debate has spent a decade on the wire. The agent moves the fight to the endpoint, where encryption was never designed to help.
How it should be built
There is another way to build AI into your private life, and it isn't a policy promise — it's a property you can check.
Privt Voice runs its entire speech model on your Mac, on-device via Apple's CoreML and Neural Engine. On the free tier no user content is transmitted at all; the only network activity is fetching the speech model at first launch, with occasional re-contact of the model host solely for cache repair. Transcripts are sealed on-device into an encrypted vault — XChaCha20-Poly1305, per-item keys, a root key gated by the Secure Enclave and Touch ID or an Argon2id passphrase — so what's stored is ciphertext the operator can't read even on the optional Pro sync. The audio buffer is overwritten in memory once the transcript is delivered; the keystroke buffer is overwritten after the text is typed; the process denies its own core dumps so a crash can't dump process memory to disk. We don't overstate it: a transcript held briefly in a managed-language Swift string can't be reliably scrubbed at all — unlike raw audio, which we can and do overwrite — and we say so in the code rather than pretend otherwise.
Privt Voice is a dictation and meeting-notes tool. It does not read your Messages, and we're not announcing that it will. The point is narrower and more durable: an assistant that helps with your words without ever needing to move them off your machine is proof that the trade the cloud keeps offering isn't the only one available. Local-first is the direction, and it's a direction you can audit line by line.
The calm version
"OpenAI killed encryption" is the wrong sentence, and being the person who says the right one is worth something. The right sentence is quieter and more useful: your encryption is fine, and it was never the thing standing between your messages and a cloud server. The endpoint was. The moment you hand an agent root-level reach into your decrypted life and route its thinking through someone else's datacenter, you've moved your conversations across a line no cipher defends.
The fix isn't a better lock on the wire. It's not building the leak in the first place — keeping the model, and the plaintext, on the machine that already holds your keys. That's buildable today. We know, because we build it.