Apple Is Tightening macOS Full Disk Access — Because AI Agents Got Too Nosy
Cupertino — October 3, 2026
The short version: Apple is adding new controls around macOS Full Disk Access — and it is naming AI agents as the reason. Going forward, users who want to grant an app this system-wide permission will have to take “very explicit user action.”
What Apple announced
In a post titled “Updates to Full Disk Access in macOS” on its Developer News site, published October 2, Apple said the permission largely bypasses the controls behind its developer APIs — it exists so backup apps can work properly — but that “some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems…without users’ full knowledge and understanding.”
Under the coming controls, users who “genuinely wish to grant an app this extraordinary level of access” will be able to do so only through “very explicit user action.” Apple called addressing the issue critical: “As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially. We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.”
Why now: the incidents that set this off
The announcement follows two awkward episodes. Inc. columnist Jason Aten reported that Meta’s Muse AI assistant knew details from his Apple Messages even though he said he never granted it permission to read his messages — Meta disputed the account, saying Messages access is entirely opt-in. Separately, Wired documented a flaw in the ChatGPT Mac app that could have let attackers reach sensitive data.
The Muse case illustrates the scale of exposure: Aten’s reporting described the app syncing more than 187,000 rows of his message history from the Mac’s local Messages database — something that only works with Full Disk Access enabled. Meta has said both Full Disk Access and an enabled Messages connector are required, but the dispute underscored how murky these permission flows feel to ordinary users.
What Full Disk Access actually covers
This is not a scoped grant like “let this app read the folder I picked.” Full Disk Access covers mail databases, message histories, browser data, and Time Machine backups — essentially everything macOS normally walls off. Apple noted the risk extends beyond the individual user: “For communication apps, this can also compromise the privacy of the people users are communicating with.” Granting an agent access to your messages grants it access to everyone who ever messaged you.
What is still unclear
Apple’s post gives no date or macOS version for the change, names no developer or app, and quotes no executive. The announcement landed the same day Microsoft’s annual threat report argued AI has tipped the near-term advantage to attackers — a reminder that the agent-permissions problem is an industry-wide reckoning, not an Apple-only one.
Why it matters
If you use AI agents on a Mac, expect louder, clearer permission prompts — and take a hard look at which apps already hold Full Disk Access (System Settings → Privacy & Security → Full Disk Access). The pattern this change targets will feel familiar to anyone who has ever clicked “allow” on a permissions dialog just to get through setup. An agent that can read your files is useful; an agent that can read everything, and send pieces of it somewhere else, is a different proposition entirely. Apple’s bet is that forcing a deliberate, explicit decision at that moment is the simplest security patch available.
Frequently asked questions
What is Full Disk Access on macOS?
A system permission that lets an app bypass most of Apple’s data-protection controls and read virtually everything on a Mac — files, mail, messages, browsing history, and Time Machine backups. It was originally designed so backup utilities could work.
What is changing?
Apple will require “very explicit user action” before an app can be granted Full Disk Access, specifically to address the risks posed by increasingly capable and autonomous AI agents. No ship date or macOS version has been announced.
Which apps triggered this?
Apple did not name any developer or app. The timing follows disputed reporting about Meta’s Muse assistant reading a journalist’s messages and a documented flaw in the ChatGPT Mac app.
When does it take effect?
Apple has not said. Developers should watch macOS beta notes and App Store review guidance for the exact flow.
Sources: TechCrunch; Apple Developer News; Unite.AI