Apple Tightens macOS Full Disk Access Controls as AI Agents Spark Privacy Fears

Posted on 3rd Oct 2026 12:05:39 in Artificial Intelligence, Machine Learning

Tagged as: Apple, macOS, AI agents, privacy, cybersecurity

Apple says it will add new controls to the "Full Disk Access" permission on macOS, warning that AI agents are making the deepest level of access a Mac app can receive too risky to hand out casually. In a statement published on its developer news site on Friday, October 2, the company said apps will soon need "very explicit user action" before they can see everything on a user's system.

The announcement lands in the middle of a boom in always-on AI agents — desktop clients such as Meta's Muse and OpenAI's Dots that ask for sweeping permissions so they can read files, send messages, and run tasks on a user's behalf. Apple's message is blunt: the more capable and autonomous those agents become, the more dangerous that permission becomes.

What Apple Announced — and What Changes

Apple's statement centers on Full Disk Access, a macOS privacy setting that gives an app access to a user's entire system — files, mail, messages, browsing history, and more. The company says the permission was originally built for backup apps and "largely sidesteps" its privacy controls "to allow backup apps to function properly on the Mac."

Now Apple says some developers are abusing that generosity. "Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users' full knowledge and understanding," Apple wrote. "For communication apps, this can also compromise the privacy of the people users are communicating with."

Going forward, Apple says it "will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action." The company framed the change as urgent: "Addressing this is critical. As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."

Apple did not say when the new controls will roll out, or exactly how the consent flow will change. The update was published quietly on Apple's developer news site rather than at a keynote — a sign of how quickly the agent privacy problem has moved from theory to policy.

Why AI Agents Triggered the Change

Desktop AI agents are the fastest-growing category of software asking for Full Disk Access. Meta's Muse, OpenAI's Dots, and open-source tools such as OpenClaw all encourage users to grant the permission so an agent can reach personal data and do more useful work. The scale is now enormous: OpenAI said this week that more than 35 million people use its agent tools ChatGPT Work and Codex, up from about 10 million in July, while Meta's Muse topped app store download charts last month.

The risks are not hypothetical. Inc. columnist Jason Aten wrote that Meta's Muse somehow knew the contents of his messages even though he believed he had denied it access. Meta spokesperson Andy Stone pushed back on the report, saying message access is "entirely opt-in" and that users must "enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content."

In August, OpenAI shipped an opt-in feature for its ChatGPT Mac app that can read, summarize, write, and send text messages on a user's behalf — functionality that requires turning on Full Disk Access so the app can reach the Messages database. Every such feature pushes users toward granting the single widest permission macOS offers.

The agent wave has even bent hardware demand. Some users now run agents on dedicated Mac minis instead of their daily machines, a practice that has helped fuel Mac mini shortages this year. But dedicated hardware is a workaround for enthusiasts, not a privacy answer baked into the operating system — which is exactly the gap Apple is now moving to close.

What Full Disk Access Really Exposes

It is worth being precise about the stakes, because "Full Disk Access" is one of the few permissions on any consumer operating system with no real boundaries. An app with FDA can read:

• Every document, photo, and file in your home folder — including backups, sync folders, and decades of archived paperwork;
• Mail and Messages databases, which contain years of conversations;
• Safari and browser history, revealing habits, research, and private browsing patterns;
• App data that is normally sandboxed, such as notes, calendars, and password manager caches.

For communication apps, the exposure extends beyond the user. If an agent can read your Messages database, it can read what everyone who texts you wrote — people who never agreed to share anything with that app. Apple flagged this explicitly in its statement, noting that access "can also compromise the privacy of the people users are communicating with."

Combine that with autonomy and the picture gets worse. An AI agent does not merely read; it acts. Malicious prompt injection — a hidden instruction planted in a document, webpage, or message — can turn broad file access into data exfiltration, and the more files an agent can reach, the more targets an attacker has. That is the "substantially" increased risk Apple is referring to.

What It Means for Mac Users and Businesses

For individual users, the practical takeaway is simple: audit your permissions now. Open System Settings, go to Privacy & Security, then Full Disk Access, and review which apps hold the permission. If an app you no longer use still has it, revoke it. When the new controls arrive, expect a more explicit confirmation step before any app receives the key to everything.

For businesses and development teams, the announcement is a signal that agent-era permission hygiene is becoming a compliance matter, not just a preference. Teams running agents on shared Macs — for testing, automation, or internal tools — should treat Full Disk Access the way they treat production credentials: grant it only where the work genuinely requires it, scope machines accordingly, and log what agents touch. The dedicated-machine habit that has driven Mac mini demand is one version of this pattern, but it only contains the blast radius; it does not eliminate it.

Developers building agent apps should watch for Apple's follow-up guidance closely. If consent flows change, onboarding scripts, help docs, and support articles that currently instruct users to "turn on Full Disk Access" will need rethinking — and apps that genuinely need the permission will have to justify it more convincingly.

The Bigger Picture

Apple's move is the strongest platform-level pushback yet against the idea that agents should get whatever access they ask for. Regulators, too, are circling: California issued a subpoena to OpenAI over its wandering agents just this week, and enterprise security vendors are racing to build agent-safety tooling. For years, the deal between users and software was that privacy controls could be bypassed when convenience demanded it. Apple is now saying that for AI agents, that deal is over — and it is willing to add friction to prove it.

No rollout date has been announced, but the direction is clear. The next macOS updates are likely to make Full Disk Access harder to hand out, more visible when granted, and easier to understand before you click through.

Sources

• Apple Developer — Updates to Full Disk Access in macOS
• The Verge — Apple will limit Mac disk access as AI agents 'substantially' increase risk
• Engadget — Apple sounds the alarm on AI agents and 'Full Disk Access'
• MacRumors — Apple Announces 'Full Disk Access' Changes on macOS Due to AI Agents
• The Economic Times (Bloomberg) — Apple to tighten Mac data controls in guard against AI agents