Apple wants a harder click before AI agents can read your whole Mac. It hasn't said when.
On October 2 Apple said it will add controls to macOS Full Disk Access because AI agents raise the stakes. It named no app and gave no date, and the Meta dispute behind it is still open.
Full Disk Access was built for backup software. Apple says so itself, in a short note it put on its developer news site on Friday, October 2: the setting “largely sidesteps” the privacy controls Mac apps normally have to respect, so that a backup tool can copy everything.
Now the company says that same switch has become a problem. “Some developers are using Full Disk Access in ways that could put users at risk,” the note reads, “exposing everything on their systems, including files, mail, messages, and even browsing history, without users’ full knowledge and understanding.” For chat apps, Apple adds, it can also expose the people on the other end of the conversation.
The fix is described in one sentence. Apple will “introduce additional controls” so that anyone who truly wants to hand an app that access can do it “only with very explicit user action.” It did not say what the new prompt looks like, and it did not say when it ships.
What Apple left out
The note doesn’t name a single app. MacRumors, The Verge and TechCrunch all connect it to Meta’s Muse agent, and MacRumors also mentions OpenAI’s Dots as part of the wave of always-on agents behind the privacy worries. That is their reading. Apple only says “AI agents.”
The trigger most outlets point to is a report from Inc. columnist Jason Aten, who wrote that Muse knew what was in his private messages even though he hadn’t given it explicit permission. Meta pushed back. Spokesperson Andy Stone said Messages access is “entirely opt-in,” and that you have to turn on both Full Disk Access and a separate Messages connector inside Muse before it can read your chats.
Those two accounts don’t actually clash as much as they sound. Meta is saying two switches are needed. Aten is saying he didn’t knowingly flip either. The open question is whether someone who granted Full Disk Access once, for some other reason, had effectively given a lot away already. According to a US Brief roundup of Ars Technica’s reporting (I couldn’t open the Ars piece itself), Meta didn’t answer follow-up questions on whether Full Disk Access alone could expose message data. The same roundup quotes Patrick Wardle, the macOS researcher who found Muse’s September zero-day, saying the permission can make many non-root files readable, including chats and browsing history.
TechCrunch also pointed to a Wired report on a flaw in the ChatGPT Mac app that could have let attackers reach sensitive data. I haven’t read the Wired piece myself, so I’m only passing along what TechCrunch says about it.
| Question | What we know |
|---|---|
| Does Apple name Meta or Muse? | No |
| Does Apple give a ship date? | No |
| Does Meta say Full Disk Access is enough to read Messages? | No, it says the Muse Messages connector must be on too |
| Has Meta said whether Full Disk Access alone exposes message data? | Not in answer to Ars Technica’s follow-up, per US Brief |
Why I think this matters
A permission that was fine when the worst consumer of it was a backup app starts to look different when the app holding it can also act on what it reads. A backup tool copies files somewhere you chose. An agent reads your mail, decides what’s relevant and then sends something, and a mistake there isn’t a bad copy, it’s a message to the wrong person. Apple is basically admitting that its one-time toggle can’t carry that load.
What I can’t tell is how far the “very explicit” step will go. If it’s a scarier warning dialog, agent makers will click past it in their onboarding flows like everyone else. If it forces something per app, with a re-confirm every so often, Mac agents get harder to set up and arguably safer. Apple hasn’t picked yet, publicly at least.
If you run Muse, Dots or any other agent on a Mac, you can check today under System Settings, Privacy & Security, Full Disk Access, and see which apps are on the list. Nobody has to wait for Apple to do that.
For more on Muse and where Meta’s agent sits right now, see our look at Amazon blocking Muse while Shopify opened checkout to agents. The broader agent containment push is in Nvidia’s OpenShell pitch.
Sources
- MacRumors: Apple Announces ‘Full Disk Access’ Changes on macOS Due to AI Agents (October 2, 2026, includes Apple’s full statement)
- The Verge: Apple will limit Mac disk access as AI agents ‘substantially’ increase risk
- TechCrunch: Apple says it’s tightening macOS ‘Full Disk Access’ controls due to new risks from AI agents (October 2, 2026)
- Ars Technica: Muse, Meta’s extraordinarily privileged AI assistant, has a serious 0-day (September 21, 2026)
- US Brief: Apple to tighten macOS Full Disk Access over AI agent risks (summarizes Reuters and Ars Technica reporting)