Apple says it will tighten macOS's 'full disk access' permission, one of the broadest privileges an app can hold, in response to AI agents. In an update on Friday, the company said it is rolling out new controls 'to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action.'
Apple's framing is blunt about why. 'Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems — including files, mail, messages, and even browsing history — without users' full knowledge and understanding,' the company wrote. 'As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.'
Full disk access is the macOS permission that lets an app read a user's entire system, largely sidestepping the per-folder privacy prompts Apple introduced years ago; the company has said the exception exists mainly so backup tools can work. Apple did not say when the change ships.
The trigger The announcement lands weeks after Inc journalist Jason Aten reported that Meta's Muse AI assistant somehow knew the contents of his messages even though he had not given the chatbot explicit permission on his iPhone or Mac. Meta spokesperson Andy Stone pushed back, saying access to Messages is 'entirely opt-in' and that a user must 'enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content.' TechCrunch reported the change earlier.
Whichever reading you take, the episode showed the gap Apple is now addressing: a single user-facing permission, designed for backup software, can hand a general-purpose assistant a system-wide view of a user's files, mail, messages and browser history. And AI agents, the company argues, make that surface more dangerous rather than less, because they can act on what they find without a human in the loop for every step.
What changes — and what doesn't So far the change is a policy signal, not a shipping build: no timeline, no beta builds and no detail on what 'very explicit user action' means in practice — a re-confirmation screen, a separate system setting, a per-agent consent prompt? Developers who legitimately need full disk access, such as backup, security and file-sync tools, will want to watch the macOS betas to see whether the new gate adds friction to their onboarding flows.
For the wider industry, it adds Apple to a growing list of platform vendors treating autonomous agents as a distinct security category that needs its own consent layer, alongside enterprise controls for agent identity and permissions.
