Apple Tightens Mac Full Disk Access Over AI Agents
Apple plans stricter consent for Full Disk Access on macOS, arguing that autonomous AI agents turn one broad approval into unlimited reading rights.
In short
Apple is rebuilding the Full Disk Access permission so users must explicitly confirm the sweeping read access an app — or an AI agent acting through it — gets to files, mail, messages and browsing history.
At a glance
- Apple announced stricter consent ahead of Full Disk Access; it named no macOS version and no ship date.
- Full Disk Access covers files, mail, messages and browsing history under a single approval, per Apple.
- Apple's reasoning: the risk of that access level grows substantially as agents get more autonomous.
- What sparked the debate: a claim that Meta's Muse agent read private messages, which Meta denies.
- Apple's statement on the change was reported on October 2, 2026.
Apple is reworking Full Disk Access on macOS so that granting it requires an explicit confirmation of what an app — or an AI agent working through that app — may read: files, mail, messages and browsing history.
What Apple is changing
Full Disk Access is the broadest file permission on a Mac, and today one approval covers all of it. Apple says it will place additional controls in front of that approval so the scope is obvious before anyone agrees to it. The company has not named a macOS version or a shipping date.
Its stated reason is developer behavior rather than a flaw in the system: some developers, Apple says, use the permission in ways that put users at risk, while those users do not grasp how much they just handed over.
Why agents change the calculation
A conventional app with Full Disk Access reads what its feature set needs. An agent decides for itself which file to open next, which turns a one-time grant into standing authority over a mailbox and a message archive. Apple expects the risk attached to this level of access to grow substantially as agents become more capable and more autonomous.
The Muse dispute
The argument turned concrete with a claim that Meta's agent Muse read a user's private messages without asking separately for them. The claim came from Inc. columnist Jason Aten, and Meta rejects it. Apple's case does not rest on that one incident — it targets the permission itself.
What is not yet confirmed
The mechanics stay open: which macOS release carries the new prompts, how fine-grained they are, and whether grants already given will have to be reconfirmed. Additional reporting on the change could not be retrieved for this article, so nothing here goes beyond Apple's own statement.
For anyone shipping Mac tooling with an agent inside it, the direction is clear enough: ask for the narrowest access that does the job, not the widest one the system offers.
FAQ
What does Full Disk Access let a Mac app read?
By Apple's own description, files, mail, messages and browsing history — all of it under one approval, with no further questions asked.
Which macOS version gets the stricter prompt?
Apple has not said. No version number and no release date have been attached to the change, so any specific version floating around is a guess.
Did Meta's Muse agent read private messages?
Inc. columnist Jason Aten says it did and Meta denies it. The claim has not been independently verified.
