ChatGPT Desktop Full Access silently blocks built-in Messages sends; Approve for me succeeds

What version of ChatGPT Desktop are you using?

26.820.60940 (build 7119)

What platform is your computer?

macOS 26.6.2, Apple Silicon

What plugin is affected?

Built-in Messages plugin 1.0.1000816

What issue are you seeing?

The Full Access preset preserves unrestricted local execution but disables approval prompts. The built-in Messages plugin still requires a safe consent path for an external send, so an already authorized Messages send can be rejected instead of presenting or automatically reviewing that consent step.

The same Messages action succeeded in the same Projectless task after switching from Full Access to Approve for me.

Steps to reproduce

1. Start a user-created Projectless task in ChatGPT Desktop.
2. Select Full Access.
3. Give exact authorization for one Messages send, including the recipient and exact message.
4. Ask ChatGPT to send it through the built-in Messages plugin.
5. Observe that no usable send-consent step is available and the action fails.
6. In the same task, switch to Approve for me.
7. Retry the same already authorized Messages action.
8. Observe that the Messages action succeeds and returns a delivery receipt.

Actual result

With Full Access, the exact initial failure was:

Message was not sent because the send was not approved.

After switching the same task to Approve for me, the sanitized delivery receipt was:

Sent successfully via iMessage at 5:38:32 PM EDT.

The recipient, phone number, message body, email context, task path, and screenshots are intentionally omitted.

Fresh Projectless validation and rollback

I tested a proposed granular Custom configuration intended to preserve unrestricted local execution while allowing Messages consent:

sandbox_mode = "danger-full-access"
approval_policy = { granular = { sandbox_approval = false, rules = false, mcp_elicitations = true, request_permissions = false, skill_approval = false } }
approvals_reviewer = "auto_review"

[plugins."messages@openai-bundled".mcp_servers.messages.tools.send_message]
approval_mode = "prompt"

Static TOML parsing and a strict Codex configuration run succeeded. An already-running Candy Project Voice task then returned a successful Messages delivery receipt for a separately authorized test message, even though that task still visibly displayed Full Access.

A newly created Projectless task produced a different result:

• The task had no Project association.
• The UI still displayed Full Access, not Custom.
• The Messages send had an exact recipient and exact message authorization.
• No confirmation dialog appeared.
• The send was rejected before delivery with:

The message was not sent because confirmation was blocked by this task’s approval settings. Switch the task to Ask for approval or Approve for me, then retry.

No message or attachment was sent from the fresh task.

The existing-task success combined with the fresh-task failure suggests task-start permission-profile precedence, startup configuration injection, or stale UI/effective-policy state may be involved. Because the fresh-task acceptance test failed, I restored the pre-change global and project permission settings and removed the Messages-specific override. Strict configuration parsing succeeds after rollback. The Custom hybrid is not commissioned as a fix.

Expected behavior

Full Access should preserve a safe consent path for built-in Messages sends, or ChatGPT Desktop should clearly explain the conflict and offer a transition to a compatible approval mode before rejecting the action. It should not silently turn the most permissive-looking preset into a failure for a consent-gated external action.

Exact recipient and message authorization must still be required. Full Access or automatic review should not authorize unsolicited sends.

Related reports (not duplicates)

• #19554 — broader approval-policy behavior affecting Computer Use, not the built-in Messages send path.
• #38469 — Voice-created task approval-modal behavior, not this same-task Messages A/B reproduction.

Performance trace and feedback upload

A performance trace was running during the fresh Projectless reproduction. The trace/feedback was submitted afterward, and ChatGPT Desktop displayed a green Feedback uploaded confirmation. That performance-trace upload did not display or return a performance-trace ID or Feedback ID.

A separate test-only /feedback submission did return Feedback ID 01a03aaa-755e-7a41-98b1-b1cb1d02eaa5. This identifier belongs to the test-only feedback submission and is not presented as the receipt for the performance trace.

No private trace, diagnostic file, screenshot, recipient information, phone number, or message content is posted publicly.

Start by reproducing the fresh Projectless task described in the issue, comparing Full Access with Approve for me and checking the displayed mode against the effective approval policy. Trace task-start permission-profile precedence, startup configuration injection, and stale UI or policy state around the Messages send path. Done means an explicitly authorized send has a safe consent path or receives a clear transition to a compatible approval mode, without permitting unsolicited sends.