OpenAI's help center now says that iCloud Mail and iCloud Calendar are available as ChatGPT plugins, "rolling out globally to all ChatGPT plans on web, desktop, and iOS, subject to workspace app controls." Both authenticate with an Apple app-specific password, not your main Apple Account password. The change is described on OpenAI's Connected apps in ChatGPT page, which was updated the day before this post.
We could not find a separate OpenAI announcement post, so everything below comes from the help center page and Apple's own documentation. Where the page is silent, we say so.
TL;DR: what is confirmed
| Question | Answer |
|---|---|
| What launched? | Two separate plugins: iCloud Mail and iCloud Calendar, both with read-only contact lookup |
| Who gets it? | All ChatGPT plans, rolling out globally, subject to workspace app controls |
| Where? | Web, desktop and iOS |
| How do you sign in? | Apple app-specific password |
| Not included | Standalone Contacts and Reminders plugins, which are outside this launch |
| Where to enable? | Settings, then Plugins |
| Not stated on the page | Whether the plugins can send or edit mail, or create events |
How to connect iCloud to ChatGPT
OpenAI's general steps for any app:
- Open Settings > Plugins and select the app or the plugin that includes it.
- Select Install plugin if shown; this may start the connection flow.
- Select Connect and, if prompted, sign in to the account that has the information you want to use.
- Review the requested services and permissions and complete any required provider authorization.
For iCloud specifically you need an app-specific password. Apple's support page says these let you sign in to your Apple Account in apps made by other developers, so the app does not store your main password. Requirements and limits from Apple:
- Two-factor authentication must be on for your Apple Account.
- Create one at account.apple.com under Sign-In and Security, then App-Specific Passwords.
- You can have up to 25 active app-specific passwords.
- You can revoke them one at a time or all at once, and changing or resetting your main Apple Account password revokes all of them.
For Mail, OpenAI says to enter your iCloud Mail address ending in @icloud.com, @me.com or @mac.com. For Calendar, enter your primary Apple Account email, which may be a different address. If you want separate control, generate one app-specific password for each plugin and label it, so you can revoke one without touching the other.
What ChatGPT can do with a connected app
The help page lists the general capabilities of connected apps: search and reference information, use supported apps as sources in deep research, interact with in-chat experiences, and, depending on the app, take supported actions such as creating or updating information. It does not list the iCloud plugins' exact tools, so we cannot tell you from the page whether they can send a message or create a calendar event. Test with a throwaway account or read the permission prompts before assuming either way.
The page also notes that ChatGPT "may ask for approval before reading information or completing an action," and that apps can be used with event-triggered tasks in Work, though the supported events it lists are Gmail messages, Slack channel messages and GitHub pull request activity, not iCloud.
Permissions: the setting that matters most
OpenAI's app permission options "may include":
- Always ask
- Allow read actions
- Allow low-risk actions
- Allow all actions, for an eligible app or account
OpenAI says Allow all actions "carries elevated risk because supported actions may run without another confirmation," and that the standard account-wide and workspace-wide selectors do not offer it. It also stresses that permissions only change when ChatGPT asks before using access the app already has; they do not grant new access. To remove access you disconnect the app or ask your administrator to disable it.
For a personal inbox, our suggestion is to start with Always ask, and move to read-only behavior once you see how it behaves. This is the same least-privilege logic we recommended when Grok gained Outlook read and write connectors.
Privacy and training: read this before connecting a personal inbox
Your email and calendar are among the most sensitive data you have. OpenAI's FAQ says:
- After you enable an app, it may access information from ChatGPT conversations, and with Memory on, relevant memories, to provide context.
- ChatGPT can use information accessed from apps as context, may remember it if Memory is enabled unless the source restricts that, and can use it to inform web search queries.
- For ChatGPT Business, Enterprise and Edu, OpenAI does not use information accessed from apps to train models by default.
- For Free, Plus, Go and Pro users, it may use that information to train models if "Improve the model for everyone" is on.
If your inbox holds anything you would not want in a training set, turn that setting off before connecting, and consider whether Memory should be on. We covered a related concern in OpenAI's human review of chats under Project Lily.
Risks specific to email access
Giving an assistant access to a mailbox creates risks beyond privacy:
- Prompt injection. Email is untrusted input. A message can contain instructions aimed at the assistant rather than you. Keep approval prompts on for any action that sends, forwards or deletes, and be careful about asking the assistant to "process my inbox" unattended.
- Credential scope. An app-specific password gives access to the services it was created for. Treat it like a key: do not reuse it, and revoke it if you stop using the plugin.
- Workspace policy. In Business, many apps are enabled by default but administrators can change access. ChatGPT Enterprise organizations can also restrict connections where the account uses a verified email domain.
- Sensitive correspondence. Banking, medical and legal mail can end up in context. Our piece on why Bank of America warned customers not to share banking passwords with AI agents is a good reminder that credentials in mail are an attractive target.
To limit what an agent can do on your computer and accounts, the approach in our Claude Desktop access restriction guide applies across tools. For teams deploying agents that touch mail and calendars, AgentBeam is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions.
If it does not connect: a troubleshooting checklist
OpenAI's help page says that when an app is missing, will not connect, cannot find expected information or cannot complete an action, you should check the selected account, the app's requirements, provider authorization and any workspace restrictions. Applied to iCloud, that translates into a short list:
- Is two-factor authentication on? Apple requires it before you can create an app-specific password at all.
- Did you use the right address? Mail wants your iCloud Mail address ending in icloud.com, me.com or mac.com. Calendar wants your primary Apple Account email, which can be a different address. Mixing them up is the most likely cause of a failed sign-in.
- Did you paste the app-specific password, not your Apple Account password? The generated one comes from the App-Specific Passwords section of your Apple Account page.
- Did something revoke it? Apple says changing or resetting your main password revokes every app-specific password, so a connection that worked last week may need a fresh one.
- Are you in a managed workspace? If the plugin shows Disabled by admin, an administrator controls it. Personal accounts with no administrator should contact OpenAI Support if the message persists.
- Are you on a supported surface? The launch covers web, desktop and iOS. The page does not mention Android for these plugins.
How it compares with the Google and Microsoft options
Connecting a personal mailbox to an assistant is not new. The help page already lists Outlook email and calendar apps, and our earlier coverage showed Grok getting Outlook access. What differs for iCloud is the sign-in method: instead of a sign-in screen with a granular consent page, you hand over a revocable app-specific password. That is simpler to set up and easy to revoke, but it is coarser than a scoped authorization, and the password grants whatever the service behind it allows. Apple does say that some third-party apps can be authorized with your Apple Account instead, so a scoped flow may exist for some tools, though the OpenAI page describes the app-specific password route for these two plugins.
Useful first prompts
Once connected, try tasks that read rather than act:
- "Summarize unread mail from the last two days and list anything that needs a reply."
- "What is on my calendar next week? Flag back-to-back meetings."
- "Find the email with the flight confirmation and give me the times."
- "Draft, but do not send, a reply to the last message from my landlord."
How this fits ChatGPT's plugin direction
The iCloud launch follows the steady widening of what ChatGPT can reach. OpenAI's help page now organizes everything as apps and plugins, with Google Drive, SharePoint, Teams, Outlook, Slack, GitHub, GitLab, Box and Notion on the same list. Voice conversations also use connected apps, as covered in ChatGPT Voice gaining plugins. For Apple users, the practical change is that a very common personal mail and calendar stack is now reachable without a workaround.
What we could not confirm
- The exact actions the iCloud plugins support.
- Whether rollout has reached every account yet; the page says it is rolling out.
- Whether usage counts differently against plan limits. The page says app use may count toward plan limits and provider limits.
We will update this post if OpenAI publishes a fuller description.
Related reading
- Grok can read, write and send Outlook mail
- ChatGPT Voice gets plugins and a seat in ChatGPT Work
- OpenAI Project Lily and ChatGPT privacy
- Bank of America: do not share banking passwords with AI agents
- Restrict Claude Desktop access with a sandbox
Details reflect OpenAI's help center and Apple's support page as of October 28, 2026 and may change as the rollout continues.