Apple says it will add new controls around the macOS setting called “Full Disk Access.” The reason sits unusually plainly in its note to developers: AI agents have “increased the risks associated with this level of access.”
How this came up
A few days earlier, Inc. columnist Jason Aten reported that Meta’s Muse app on his Mac knew the contents of his private messages — without him, by his own account, ever having granted the agent permission. Meta disputed the claim. Shortly before that, Wired described a flaw in ChatGPT’s Mac app that could have let attackers reach sensitive data.
What the setting actually grants
Full Disk Access was built for backup software. Grant it to an app and you hand over access to files, mail, messages, and even browsing history. For an agent meant to get things done on your machine, that’s a master key.
Apple’s wording: “Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems…without users’ full knowledge and understanding.”
What changes
Going forward, granting it should require “very explicit user action.” Apple frames this as urgent: as agents get more capable and autonomous, the risks of this level of access will grow substantially. What happens technically, Apple hasn’t said — it didn’t answer TechCrunch’s question about the change.
One distinction matters, and TechCrunch corrected its own wording after publishing to make it: Apple isn’t limiting the permission. It’s demanding more deliberate consent.
This permission was already too broad before agents existed
Full Disk Access has for years been the one macOS permission where the system doesn’t ask what an app wants to read, only whether it may read everything. With backup tools that just about held up. With an agent working in the background, deciding on its own which file matters next, it doesn’t.
It also shows why the explicitly-connected-folder approach — how Claude Desktop and Cowork work on the Mac — isn’t a convenience tradeoff but the actual security model. An agent that can only see the three folders you showed it can only do damage in those three folders. The notable thing about this week is that Apple is the one making that point, not the AI industry.
Sources: