OpenAI rolled out plugins on October 27, 2026, enabling ChatGPT across the web, desktop, and iOS on all tiers—including free accounts—to connect directly to iCloud Mail and iCloud Calendar, though Notebookcheck reported that disconnecting the service within the chat interface fails to revoke the active app-specific password left behind on Apple’s servers.
What the iCloud Plugins Can Access in Your Account
The integration spans specific Apple email domains, covering addresses ending in @icloud.com, @me.com, and @mac.com, according to MacRumors. Gmail or Outlook accounts bundled into Apple’s native iOS Mail app remain outside the chatbot’s reach. Once authorized, the Mail plugin lets users search and read messages, draft responses, manage correspondence, and send emails. The Calendar plugin handles creating and updating events. Both plugins can query contacts but cannot edit them, as noted by Notebookcheck.
How to Connect iCloud Mail and Calendar to ChatGPTChatGPT can now work with your iCloud Mail and Calendar, letting you manage emails and appointments through natural-language requests.OpenAI introduced two separate plugins on October 27, 2026. iCloud Mail supports searching… pic.twitter.com/OBM0g5xmks
Engadget noted that these plugins operate independently from the direct desktop app integrations found on macOS. They also differ from Google’s recent approach with Gemini in Chrome, which pulls autofill details straight from Gmail.
The Security Trap of App-Specific Passwords
Authorization requires generating an app-specific password at Apple’s security portal, as OpenAI relies on this older authentication method rather than Apple’s newer token-based system. Users must navigate to account.apple.com under Sign-In and Security to generate the credential using two-factor authentication.
The core security risk lies in disconnection behavior. As Notebookcheck detailed, disconnecting an iCloud connection inside ChatGPT leaves the password completely active on Apple’s servers. The credential carries no expiry date and remains valid until manually removed via the Apple Account dashboard, a full account password reset, or a global revocation.
Users who only want to test the integration must manually delete the entry from their Apple account settings afterward. Apple permits up to 25 active app-specific passwords at any given time.
Data Controls and Model Training Settings
Account settings dictate whether personal inbox data feeds back into OpenAI’s machine learning pipelines. For Free, Go, Plus, and Pro tiers, OpenAI may use information accessed from third-party apps to train its models if the “Improve the model for everyone” toggle remains enabled under Data Controls. Business, Enterprise, and Education accounts are excluded from this behavior by default.
Furthermore, if Memory is turned on, the plugins can pull context from saved memories during interactions. Removing the plugin or disconnecting the account does not automatically delete existing chat logs or saved memories, requiring users to purge those components separately.
