Apple said it will add new controls to the macOS Full Disk Access permission, warning that increasingly autonomous AI agents make that level of access substantially riskier.
The big picture: Full Disk Access exists so backup software can work, and it sidesteps the usual macOS privacy prompts. Apple said in a developer post Friday that some developers are using it in ways that could put users at risk.
- The company wrote that the permission can expose "everything on their systems, including files, mail, messages, and even browsing history, without users’ full knowledge and understanding," and that for communication apps it can also compromise the privacy of the people a user is talking to.
What they're saying: "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially," Apple said, promising that granting it will soon require "very explicit user action." It called addressing the issue critical.
The backstory: The post came two weeks after columnist Jason Aten wrote that Meta’s general-purpose AI agent Muse sent him a notification referencing an Apple Messages thread with a co-worker, access he said he had granted.
The other side: Meta CTO David Singleton responded that the integration is opt in: "Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled."
- macOS security researcher Patrick Wardle questioned that framing, telling Ars Technica that with full disk access "any (non-root file), is readable, browsing history, browser cookies, chats, etc." Apple named no company in its post.
Why it matters: Agentic apps are asking for the broadest permission macOS offers, and today one checkbox hands over a decade of messages. Worth doing this week: open System Settings, Privacy and Security, Full Disk Access, and remove anything there that is not a backup tool.
