Apple Restricts macOS Full Disk Access as AI Agents Push Privacy to the Brink

Apple has confirmed it will tighten one of macOS’s most powerful privacy permissions, announcing new controls around Full Disk Access (FDA) in a post on its developer news site in early October. Going forward, granting an application sweeping access to a Mac’s files, mail, messages and browsing history will require what the company calls “very explicit user action” rather than a couple of clicks.

Apple’s stated reason is unambiguous: AI agents. The company says the permission, designed to let backup utilities work, has drifted far beyond its original purpose — and that increasingly autonomous software makes that drift materially dangerous. No timeline, no named applications and no implementation details were offered.

• Stricter consent: Full Disk Access will only be granted through a deliberate, explicit user action, with the risks spelled out first.
• AI agents blamed: Apple explicitly cites agentic AI as the reason the permission has become a liability.
• No date, no details: Apple didn’t say when the controls arrive, how they work, or what happens to apps that already hold FDA.

What Full Disk Access Actually Unlocks

Full Disk Access lives under System Settings > Privacy & Security > Full Disk Access and was introduced with macOS Mojave (10.14). Once enabled, an app can bypass many of the protections macOS builds around private data, reading and writing files that other software simply cannot touch — Mail content, Messages, Safari data and Time Machine backups among them.

Apple designed the toggle for legitimate system-wide backup tools. The problem is that developers began requesting it for purposes nobody signed up for. In its post, Apple framed the risk bluntly:

“Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.”

Security researcher Patrick Wardle of Objective-See has described the technical reality in similar terms, noting that with FDA enabled, essentially any non-root file becomes readable: browsing history, browser cookies, chat logs and more.

Why Now: Muse, Permissions and a Journalist’s Messages

The timing points squarely at the debate surrounding desktop AI agents. Meta’s Muse arrived on the Mac as an agent with broad system access in September 2026, and Amazon blocked the app from its platform that same month. In early October, columnist Jason Aten wrote that Muse appeared to know the contents of his private messages. Meta denies any unauthorized access.

Meta has argued that reading messages requires two separate switches to be flipped. David Singleton, Meta’s CTO, put it this way:

“The Messages integration in the Muse Mac app is opt in. Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled.”

Meta VP of communications Andy Stone made the same point, saying the journalist must have enabled both Full Disk Access and the Messages connector for Muse. Apple, for its part, named no company and no product — only “some developers.”

Nor is that the only pressure point. Wardle also demonstrated a proof-of-concept exploit dubbed not-a-mused against Muse’s Mac app, a now-patched flaw that let any local process swipe the token authenticating users to their Muse account and redirect the app’s dictation traffic via an undocumented setting called endo_voyager_dictation_endpoint. Wardle was separately credited for reporting CVE-2026-100754, a ChatGPT for Mac vulnerability that could have exposed chat logs.

The Questions Apple Left Unanswered

The direction is clear, but the mechanics are not. Developers who depend on FDA today will need to redesign onboarding so users understand exactly what they are approving. Apple hasn’t said whether the change applies only to new installations or also to permissions already granted; if existing grants must be reconfirmed, millions of Mac users face an immediate reauthorization cycle. Nor has the company explained how macOS will technically distinguish a legitimate backup or indexing tool from an agent treating FDA as a shortcut. The change does not appear in the current macOS 27.2 betas, and the most disruptive path — deprecating FDA in favour of granular, per-data-type permissions — would hand users far more meaningful control, which is precisely where Apple’s language appears to be heading.

Tightening Full Disk Access is the right call, and Apple deserves credit for questioning its own permission model. But doing it now — months after desktop agents had already been handed unfiltered access to the disks of countless Macs — suggests the company moved in response to a public argument rather than ahead of a technical risk. With regulators increasingly interested in AI autonomy, the real test is whether Apple follows through with granular permissions by default, or settles for a better-worded warning.