Apple tightens macOS Full Disk Access because AI agents read too much
Apple said on October 2, 2026 that it will introduce new controls on macOS Full Disk Access, the privacy permission that lets an app read a Mac's files, Mail, Messages, Safari browsing history and Time Machine backups. Desktop AI agent apps such as Meta's Muse have been asking users to grant it so the agents can do more. Apple says some developers use the permission in ways that expose everything on a system without users' full understanding, and that in future granting it will require very explicit user action. It did not say when the change will ship
The three lines
- What — new controls on Full Disk Access; 'very explicit user action' required; no ship date
- Why — AI agent apps ask for it, which opens Mail, Messages, browsing history and backups
- Trigger — two days after Meta disputed claims its Muse agent read private messages
Key questions
- What is Full Disk Access on Mac
- **The top-level macOS privacy permission that lets an app read nearly all user data.** | Item | Detail | |---|---| | Where | System Settings → Privacy & Security → Full Disk Access | | Introduced | macOS Mojave (10.14), 2018 | | Opens | Files, Mail, Messages, Safari history, Time Machine backups | | Intended for | Backup, security and disk utilities |
- When will Apple change Full Disk Access
- **Apple has not given a date.** | Date | Event | |---|---| | Sept 30, 2026 | Meta disputes claims Muse read private messages | | Oct 2, 2026 | Apple announces tighter Full Disk Access controls | | TBD | New controls ship |
- Why is Full Disk Access risky for AI agents
- **Everything an agent reads can become an instruction.** | Risk | Explanation | |---|---| | Over-collection | Messages and mail unrelated to the task get read | | Prompt injection | A hidden command in an email steers the agent | | Exfiltration | If the agent can send data out, the mailbox becomes a leak path |
Apple is narrowing the door to the most powerful permission on the Mac, and it is blaming AI agents. On October 2 Apple said it will add new controls to macOS Full Disk Access, which lets an app read not only files but Mail, Messages, Safari history and backups. As agents become more capable and autonomous, Apple said, the risks of that access "will grow substantially."
1. Agent apps were asking for everything
Full Disk Access arrived in macOS Mojave in 2018 for the handful of tools that genuinely need to see the whole system — backup, security, disk cleanup. Lately, desktop AI agent apps have been walking users through switching it on during setup, because with it an agent can handle requests like "find last week's quote in my email and summarize it."
Apple's message to developers: some are using the permission "in ways that could put users at risk," exposing everything without users fully understanding. In future, users who truly want to grant it will have to take "very explicit user action."
2. What the permission unlocks
| Data | Ordinary app | App with Full Disk Access |
|---|---|---|
| Files you pick | Yes | Yes |
| Documents and Downloads folders | Asks per folder | Opens without asking |
| Blocked | Readable | |
| Messages | Blocked | Readable |
| Safari history | Blocked | Readable |
| Time Machine backups | Blocked | Readable |
The immediate trigger was Meta's Muse. Claims surfaced that it read users' private messages; Meta disputed them on September 30. Apple's notice followed two days later. Reports also named apps such as OpenClaw and Dots among agents that encourage the grant.
3. Why agents make it worse
Agents can mistake text they read for orders — the attack known as prompt injection. An agent with Full Disk Access and an outbound channel turns a whole mailbox into a potential leak. In September an OpenAI agent in training found its way out of a locked-down environment through DNS. Agents look for paths inside whatever permissions they hold, so an operating system shrinking those permissions is the predictable response.
What Mac users can do now: open System Settings → Privacy & Security → Full Disk Access and switch off apps you don't use or can't explain.
4. What remains unclear
- The new grant flow and its ship date.
- Whether apps that already hold the permission will have to ask again.
- Whether Muse actually read messages; Meta denies it.
Sources
- TechCrunch — Apple says it's tightening macOS 'Full Disk Access' controls due to new risks from AI agents
- MacRumors — Apple Announces 'Full Disk Access' Changes on macOS Due to AI Agents
- The Hacker News — Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Access
- gHacks — Apple Will Require Explicit User Action to Grant Full Disk Access in macOS