Third-Party AI Agent in iPhone Messages: What Poke Reveals About Apple's AI Strategy

A third-party AI service called Poke appears to have been admitted into the iPhone's native Messages app through Apple's existing business messaging channel, making it what Poke claims is the first outside AI agent permitted to interact with users there, 9to5Mac reported this week. The mechanism matters as much as the headline.

This is not Apple opening personal iMessage conversations to outside AI. Poke appears to have been admitted through Messages for Business, Apple's existing, gated infrastructure that lets iPhone users contact companies inside native Messages threads. A Poke conversation sits in your app the same way a bank support thread does. That channel has always been controlled by Apple, and Poke appears to have been admitted through Apple's existing business messaging approval process, not through any new opening of iMessage itself, per 9to5Mac.

The timing sharpens the significance. This approval lands days before WWDC, where Apple's new version of Siri is expected to be unveiled on June 9, MacRumors reported three weeks ago. Poke shows what "Apple letting in outside AI" looks like before Apple has explained it on stage. That makes it a useful object lesson in Apple's permission model, whatever gets announced this week.

What Poke does and what it's like to use as a third-party AI agent in iPhone Messages

Setup requires no app download. Users visit Poke.com, enter a phone number, and Poke appears as a contact thread inside the native Messages app. The whole onboarding takes under a minute, TechCrunch reported two months ago. From there, every interaction happens over text.

Poke uses a middleware layer called Linq to embed inside messaging platforms, including iMessage, SMS, and Telegram. WhatsApp is largely off the table; Meta blocked third-party general-purpose chatbots from its platform last fall, per TechCrunch.

The breadth of what Poke can actually do is what distinguishes it from a novelty. It offers pre-built "recipes" spanning scheduling, travel, finance, health, email, home, school, and developer tools. Activating each requires a tap and, when a task involves an outside service, a standard authorization step to grant the necessary access, according to TechCrunch. This is an agent that can act on your behalf across real services, not just answer questions.

Pricing is free to start. During beta, paid plans were negotiated directly with the AI and ran between roughly $10 and $30 per month. Sign-ups have increased tenfold over recent months, though the company hasn't disclosed hard figures, TechCrunch noted.

Poke claims to be the first and only AI agent Apple has approved to operate through iMessage. That claim originates with Poke's own announcement and has been echoed by 9to5Mac this week. Apple has not confirmed or commented on the approval independently, so "first and only" should be read as Poke's assertion.

Why Apple Messages for Business AI is the real story here

The most important fact about Poke's approval is that Apple didn't need to build anything new to allow it. Messages for Business already existed as a controlled, Apple-vetted business channel. Poke appears to have cleared that process. It didn't find a loophole; it went through a door Apple had already installed, per 9to5Mac. That's precisely what makes this approval useful as a signal: it shows what Apple's AI permission model looks like when it's working as designed.

Apple's core challenge with AI agents is containment. Autonomous software that books flights, sends emails, or modifies calendar data is harder to sandbox than a passive app that only displays content. Apple wants to support AI agents in the App Store while specifically preventing what it describes as "rogue AI agents deleting content and causing other problems," MacRumors reported citing The Information three weeks ago.

Apple has already shown where it draws the line. Earlier this year, it blocked updates for AI coding apps that violated App Store rules prohibiting software from executing code that alters its own or another app's functionality, per MacRumors. Agentic capability is acceptable when Apple controls the approval path. Unrestricted execution is not.

The same logic is extending to Siri. Apple has been contacting app developers to connect specific capabilities, like booking flights and adding calendar events, into the new version of Siri and Apple Intelligence. It is also moving toward letting users choose from multiple AI models rather than defaulting only to OpenAI's ChatGPT, according to MacRumors citing The Information three weeks ago. Apple is telling some developers it does not plan to charge commissions during the early stages of these partnerships, but that fees are a possibility in the future.

Messages for Business, App Store agent vetting, and Siri model integrations are three versions of the same strategy: controlled entry points for outside AI, not an open ecosystem. Poke got through one of them.

What we still don't know

Several questions don't have answers yet, and WWDC may only partially close the gap.

It's unclear whether Apple will allow additional AI agents into Messages for Business, or whether Poke's approval was a one-off. Apple has not published vetting criteria for AI agents in that channel, so there's no public record of what Poke specifically had to demonstrate to gain access. Whether Messages for Business threads carry the same end-to-end encryption as standard iMessage conversations is also not documented publicly by Apple, and neither Poke nor Apple has addressed this for AI agent use cases. On the commercial side, Apple is telling developers that Siri partnership fees are a possibility in the future, per MacRumors, but whether that same structure would apply to Messages for Business AI agents is an open question.

What Apple announces at WWDC this week will be the first real evidence of whether any of this gets formalized.

What users should know before signing up

The privacy picture for AI operating inside a messaging surface is more complicated than it first appears. When AI tools compose or relay messages, those providers typically receive at least a temporary server-side copy of the message content, the Electronic Frontier Foundation noted last October. "Inside Messages" doesn't mean private by default.

Apple's existing behavior illustrates this. When Siri dictates a message to be sent via WhatsApp, both the message text and recipient metadata are routed to Apple's servers, a finding confirmed by independent researchers, per the EFF. Apple says it doesn't retain the transcript unless the user has opted into "Improve Siri and Dictation," but the routing still happens. The encryption status of Messages for Business threads in AI agent use cases remains undocumented.

Poke's stated practices: by default, staff cannot access the contents of user tokens, and logs and analytics are visible only if a user explicitly opts in through account settings, according to TechCrunch two months ago. The company describes a multi-layer security model including regular penetration testing and restricted employee permissions.

For users, the appeal is the low-friction setup and broad task range. The main unresolved issue is how Apple handles privacy and encryption in this specific channel. Users who authorize Poke to take actions on third-party services, booking, scheduling, managing email, are extending their data exposure beyond the Messages conversation itself, and the terms are worth reading before doing so.

What comes next

Poke's arrival in Messages is concrete: a third-party AI agent is now operating inside a native Apple app, taking real actions on behalf of real users. The route it took is what makes it meaningful. It entered through infrastructure Apple already governed, not through a new opening of iMessage or a new developer API, per 9to5Mac.

For developers and industry observers, the significant question is whether Apple formalizes this pathway. Apple is simultaneously working on App Store frameworks for AI agents and blocking those that exceed existing rules, MacRumors reported three weeks ago. If Messages for Business becomes a recognized, documented channel for approved AI agents, with explicit vetting criteria, defined permission scopes, and an eventual commission structure, Poke will look like the first approved case in a new category. If Apple never formalizes it, this remains a narrow exception. This week's WWDC announcements will be the first real evidence of which direction Apple is headed.