Apple to tighten macOS Full Disk Access over AI agent risks
Apple said Friday it will add controls so apps get Full Disk Access on Mac only after very explicit user action. The company cited AI agents and developers exposing files, mail, messages, and browsing history. Meta says its Muse agent needs Full Disk Access plus a separate Messages setting to read chats.
AI-assisted · US Brief desk · Sources listed below
What happened
In a post on Apple’s developer news site, the company said Full Disk Access largely sidesteps normal Mac privacy controls so backup apps can work. “Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding,” Apple wrote. For communication apps, it said that can also affect people on the other end of a chat. Apple did not say when the new controls will ship.
Why it matters
Desktop AI agents often ask for deep system access. Apple’s move signals that the company thinks the current Full Disk Access prompt is not clear enough as those agents spread. Backup and disk-utility apps that legitimately need full access will still need a path that users understand.
What’s next
Watch for the macOS update that ships the new controls, developer guidance for backup apps, and any product changes from Meta or other agent makers that rely on Full Disk Access.
More context
Apple said Friday it will add new controls for Full Disk Access on macOS so apps can get that permission only after very explicit user action. The company said AI agents raise the privacy stakes of a setting that can reach files, mail, messages, and browsing history.
Why now: The announcement follows reports that Meta’s Muse Mac agent appeared to know the content of a journalist’s Apple Messages. Inc. columnist Jason Aten said he had not enabled Full Disk Access, Reuters reported. TechCrunch also noted a Wired report that a flaw in ChatGPT’s Mac app could have let hackers reach sensitive data. Apple did not name Meta, Muse, or any other app in Friday’s statement.
Meta’s response: Meta CTO David Singleton has said Muse’s Messages integration is opt-in. He said the agent can read Messages only if macOS Full Disk Access is granted and a separate Messages connector is enabled in Muse. Meta spokesperson Andy Stone said that access can be revoked at any time, Reuters reported. Ars Technica reported that Meta did not answer follow-up questions Friday about whether Full Disk Access alone could expose message data. macOS security researcher Patrick Wardle told Ars that Full Disk Access can make many non-root files readable, including chats and browsing history.
Uncertainty: Apple has not published the exact interface, timing, or whether existing Full Disk Access grants will be revoked or re-prompted. Whether Meta will change Muse’s permission flow after the policy shift is not yet public.
6 listed sources
- Apple Developer News, Oct 2, 2026: Updates to Full Disk Access in macOS
- TechCrunch (Sarah Perez), Oct 2, 2026: Apple says it’s tightening macOS ‘Full Disk Access’ controls due to new risks from AI agents
- Ars Technica (Dan Goodin), Oct 2, 2026: Apple changes full-disk access permissions to curb abuse from AI agents
- MacRumors (Joe Rossignol), Oct 2, 2026: Apple Announces ‘Full Disk Access’ Changes on macOS Due to AI Agents
- Reuters via CNA, Oct 2, 2026: Apple says it will flag AI requests for Mac data after Meta's Muse draws complaints
- Sourcing note: Apple’s developer post is the primary document. TechCrunch, Ars Technica, and MacRumors are same-day tech trade coverage. Meta’s response is from Ars Technica’s quote of CTO David Singleton and Meta PR. No same-day Fox News, New York Post, Washington Examiner, or Breitbart write-up was found for this macOS FDA change.
References listed by US Brief; a source count is not a verification score.
Editorial sourcing notes
Primary: Apple Developer News, Oct 2, 2026 — “Updates to Full Disk Access in macOS” (full statement on FDA purpose for backups, developer misuse risk, AI-agent risk, and “very explicit user action”). Same-day coverage: TechCrunch (Sarah Perez, 11:11 a.m. PT), MacRumors (Joe Rossignol, 12:59 p.m. PT), Ars Technica (Dan Goodin, 7:03 p.m.) with Meta CTO David Singleton’s opt-in framing and Patrick Wardle FDA technical context. Muse/Aten background attributed to those outlets’ reporting of Inc.’s Jason Aten column and Meta’s rebuttal — US Brief has not independently verified Aten’s permission settings. Wired ChatGPT Mac-app flaw and Amazon Muse block are attributed context from Ars/TechCrunch, not the core FDA decision. Apple did not name Meta. No rollout date announced. No Fox News, NY Post, Washington Examiner, or Breitbart story on this FDA change found at draft time (~7:55 p.m. PT). Re-checked 8:01 PM PT Oct 2: facts unchanged; added Reuters (Meta spokesperson Andy Stone; Aten says he had not enabled Full Disk Access) and the direct Apple post URL.
Like US Brief? You can support it with a tip.