ChatGPT Dots Texting Explained: Proactive AI Texts via RCS and iMessage
Key Takeaways
- OpenAI announced on 28 October 2026 that ChatGPT Dots can now text users proactively, in a preview for ChatGPT Pro subscribers in the United States.
- On Android, Dots reach users via RCS in Google Messages; on iPhone, they reach users via iMessage.
- Setup runs through a Dot’s profile in the ChatGPT app: choose Texting, enter and verify a phone number, save the contact card, then message the Dot.
- A Dot does not just reply — it initiates. Ask it to watch a price, a deadline or a trip, and it texts you when something changes, with text, photos or voice notes.
- Conversations are one-to-one only: no group chats, no phone calls, no FaceTime through the channel.
- Memory and context are shared with ChatGPT, so a texting thread inherits whatever context and plugin access that Dot already has.
- Messages run through Linq, a third-party messaging provider, and key privacy details — how long messages are retained, how individual threads are deleted, and encryption across the whole delivery path — remain unclear.
- OpenAI says Dots do not get access to your other message threads: the channel is a dedicated one-to-one connection, not a window into your inbox.
From app to inbox: what changed
Until this announcement, ChatGPT Dots lived where AI agents usually live: inside an app. Dots are OpenAI’s always-on background agents, introduced about a month before the texting announcement, built to handle tasks in the background rather than wait for a prompt. You opened ChatGPT, or Slack, or Microsoft Teams, and checked in on what your Dot was doing. The agent waited for you.
Texting reverses that. A Dot can now send you a proactive text update on its own, inside the messaging app you already check dozens of times a day. OpenAI announced the feature on 28 October 2026, describing it as rolling out as a preview for Pro users in the US. Android users reach a Dot through RCS in Google Messages, while iPhone users reach it through iMessage. TechTimes, reporting the announcement, called it the first time a major commercial AI agent had established a proactive channel inside both primary US messaging ecosystems simultaneously. That claim is TechTimes’ framing, but the underlying fact is not in dispute: no other mainstream agent was texting users unprompted inside both iMessage and RCS at the time.
The shift matters because it removes the main friction that has limited agent engagement. A user must decide to open an AI app; a user does not decide to open a messaging app, because messages from colleagues, family and services are already arriving there. A Dot that surfaces a relevant update in that same stream operates on fundamentally different engagement dynamics from one that requires an explicit context switch. That is the strategic logic of the whole feature, and it is also the reason its privacy questions deserve more scrutiny than a normal feature launch: the more an agent lives where your personal messages live, the more carefully its boundaries need to be drawn.
How setup works
Setup follows a straightforward flow, and it is worth describing exactly, because several of the privacy implications follow from it. Open a Dot’s profile in the ChatGPT mobile app, desktop app or desktop browser and select Texting. Enter and verify your phone number, save the contact card you receive, then send your Dot a message. iPhone users must send from their verified iMessage number, while Android users need RCS enabled in their messaging app.
The intended workflow, in OpenAI’s example, is simple: hand a Dot something to track — a product’s price, a travel itinerary, a deadline — using text, a photo or a voice note, and it texts back on its own once it detects a noteworthy change. Those proactive updates are not limited to plain text. OpenAI says a Dot can send photos or voice notes as part of an unprompted alert, making the channel richer than a standard SMS thread.
Two limits are built in from the start. First, Dot texting supports one-to-one conversations only, not group chats, phone calls or FaceTime. Second, if a task requires approval, the Dot sends a link to review the request inside ChatGPT rather than handling the approval entirely through Messages. That second limit is a deliberate safety choice: the highest-stakes decisions stay in a controlled interface, not in a text thread where a stray reply could be misread as consent. Users who want to stop receiving Dot texts can reply STOP; deleting a Dot entirely, including its memories and scheduled tasks, requires using the Reset function inside the ChatGPT app.
Who can use it right now is narrow. The announcement confirms a preview rolling out to US ChatGPT Pro subscribers. It does not specify availability for Plus, Go, Free, Business or Enterprise accounts, or for accounts outside the US. TechTimes adds that access within the eligible subscriber base is described as limited and rolling — not every Pro account receives it simultaneously — and that Dot is excluded entirely from the European Economic Area, Switzerland and the United Kingdom, according to OpenAI’s Help Center documentation. No timeline for expansion to other plans or countries appears in the sources covering this rollout, so switching tiers specifically to chase this feature is not something the current evidence supports.
What the Dot knows: shared memory and context
One detail matters before linking a thread, and it is easy to miss in the excitement of a new channel. A Dot carries context from conversations started elsewhere and keeps access to the same connected plugins it already had. That is convenient for someone who has already built a working relationship with a particular Dot — if it learned how you prefer summaries on Tuesday, that context is available when you text on Thursday — but it also means a newly linked texting thread inherits whatever context and plugin access that Dot has already accumulated, rather than starting from a blank slate.
OpenAI has documented how Dots share memory with ChatGPT, retain context, and use data for model improvement. Its “Improve the model for everyone” setting controls whether eligible Dots conversations and work may be used for model training. Dots can retain context until deleted, although deleting a Dot does not automatically remove separately stored conversations or files. Before sending sensitive information through Dot texting, it is worth reviewing OpenAI’s Dots privacy FAQ and ChatGPT’s Data Controls, including that model-improvement setting — and remembering that the general rules for Dots do not automatically answer the channel-specific questions below.
This is also where a broader caution applies to anyone connecting AI agents to personal tools. Our AI agent security checklist makes the same point in a different setting: before connecting any tool, check what it can access, what it retains, and how you revoke that access. A texting agent inherits permissions, so the time to audit those permissions is before you link the thread, not after it has been texting you for a month.
The Linq layer: how the messages actually travel
The most technically interesting part of the announcement is also the least visible to users: the messages do not travel through an official Apple channel, because Apple has never published an official iMessage API for third-party developers. Instead, OpenAI uses Linq, a third-party messaging provider, to send and receive Dot texts. Linq is a Birmingham, Alabama-based messaging startup whose infrastructure routes messages so that they appear as blue iMessage bubbles on recipients’ iPhones, according to TechTimes’ reporting.
That architecture carries a continuity risk that users should understand. Apple has previously moved to block services using comparable techniques — most notably Beeper Mini, which used similar methods to deliver iMessage to Android devices, in December 2023. OpenAI’s iMessage channel operates on the same structural dependency: Linq maintaining access that Apple has not granted. Linq’s service claims end-to-end encryption and holds SOC 2 Type II certification, which provides independent auditor attestation of its security controls, but Linq’s claim that even it cannot read message contents has not been verified by an independent security audit, according to TechTimes. And messages routed through Linq’s infrastructure sit outside Apple’s own iMessage protocol trust model, including its PQ3 post-quantum encryption, so the encryption properties of the iMessage channel depend on Linq’s implementation rather than Apple’s.
The RCS side is architecturally different. RCS is an open GSMA standard deployed by carriers, and Apple and Google rolled out cross-platform end-to-end encrypted RCS in May 2026, according to TechTimes. The open standard means RCS access does not carry the same unauthorised-access risk as the iMessage layer. But Dot’s RCS messages still flow through Linq’s infrastructure, and the same unaudited-encryption caveat applies there. The honest summary is that the two channels differ in their dependence on Apple, but share a dependence on Linq — and Linq is the party whose retention and encryption practices are least documented in public.
What OpenAI confirms — and what it leaves open
OpenAI’s framing, quoted directly from the announcement, is specific: “Safe, secure texting via iMessage or RCS. You’re the only one who can text your dot, and your dot can only text you.” That is a statement about who can contact the Dot, and it is an important boundary: enabling Dot as a texting contact grants the agent no access to any other messages in a user’s inbox. The feature establishes a dedicated channel, not a window into the broader message history on a user’s phone. OpenAI has been explicit on that point, and it answers the most alarming version of the privacy question — no, your Dot cannot read your other texts.
What the announcement does not establish is almost as important. As Gadget Hacks’ analysis notes, the texting announcement leaves channel-specific questions unresolved, including how long messages remain with the messaging provider and how individual messaging threads are deleted. OpenAI confirms that it uses Linq and says it conducted penetration testing with its own models and outside security firms, but that disclosure identifies an additional party involved in message delivery without establishing exactly how long Linq retains message content or metadata. What remains unclear is how the general Dots rules on memory, deletion and training apply to copies of text messages held by the provider, whether individual texting threads can be deleted separately, and what encryption protections apply across the entire delivery path.
There is a related distinction worth keeping clear. OpenAI runs a separate integration — a macOS plugin launched in August that lets ChatGPT read and send from a user’s actual Apple Messages history on a Mac — which raised concerns because it required Full Disk Access, Contacts and Automation permissions. That plugin and the new Dots texting feature are different products with different permission models, so those specific criticisms do not transfer directly to Dots. The useful takeaway is narrower: OpenAI’s messaging integrations vary in scope, and the retention or training rules for one do not automatically apply to another. Judge Dots texting on its own documentation, not on the reputation of a different product.
A further security consideration is prompt injection. AI agents that can receive messages from outside the ChatGPT environment are exposed to a documented attack class: a message crafted to redirect the agent’s behaviour, exfiltrate data or execute unauthorised actions. OpenAI addressed this threat at the platform level with ChatGPT Lockdown Mode, introduced in February 2026, which disables live web access, image responses, Agent Mode network calls and file downloads when active. OpenAI’s own documentation notes that its safeguards do not eliminate prompt injection — they reduce the attack surface. Users enabling the texting channel on accounts where a Dot has broad app permissions should be aware that the text channel adds a new surface for that class of attack, which is another reason to start with low-stakes tasks.
How Dots texting compares — and what to do next
Dots are not the first AI assistant to show up in a Messages thread. Google previously said users could chat with Gemini directly inside Google Messages, according to a Google blog post from May 2024. The architectural difference is that Gemini is presented within Google Messages itself, while a Dot requires linking through an external ChatGPT account. That is a structural difference, not a current feature comparison: nothing in the research covering the Dots rollout establishes what Gemini’s feature set inside Messages looks like as of this week, more than two years after that announcement.
The competitive comparison most often drawn is with Anthropic’s Claude Duet, an always-on agent launched as a research preview on 21 October 2026. What Duet explicitly cannot do, according to TechTimes, is send texts or call contacts — it interacts inside Anthropic’s own interface, not inside native messaging. On that single capability, Dot currently holds a structural advantage: it can find the user rather than waiting to be found. Whether that advantage lasts depends partly on Apple, partly on Linq, and partly on whether users actually want proactive AI texts — a question no launch announcement can answer.
For eligible US Pro subscribers curious about the feature, the sensible path is to open a Dot’s profile in ChatGPT and look for the messaging option, then test it with something low-stakes, like a price-tracking task or a travel itinerary check, before trusting it with anything sensitive. Review the Dots privacy FAQ and Data Controls first, check what plugins and context the Dot already holds, and remember the open questions: retention with Linq, per-thread deletion, and encryption across the full delivery path are all unconfirmed at the time of writing. For everyone else — Plus, Free, Business and Enterprise users, and users outside the US — there is not much to act on yet. Watching OpenAI’s official channels for an expansion announcement is the more useful move, and the feature’s dependence on unauthorised iMessage access means its long-term availability on iPhone is not guaranteed even for those who have it today.
The broader context is worth a final note. Dots texting is part of a wave of agents moving out of dedicated apps and into the places people already spend their attention — a trend our report on the OpenAI and ServiceNow partnership bringing workflows to ChatGPT illustrates from the enterprise side, and our guide to how much an AI agent costs frames from the buyer’s side. Agents that can reach you are more useful than agents you must remember to open. They are also harder to ignore, harder to audit, and harder to switch off. Dots texting is the clearest consumer test yet of whether users want that trade — and whether they will accept it when the plumbing runs through a third party Apple never authorised.
