Apple Plans Tougher Mac Controls on Full Disk Access, Citing the Risk From AI Agents

Apple has told Mac developers it will add new controls around Full Disk Access, the macOS permission that lets an app read nearly everything on a computer. The company says users should only be able to grant it through very explicit action, and it points to AI agents as a reason the risk is growing. Apple has not said which version of macOS will carry the change, or when (MacRumors, Macworld).

What Apple said

The notice appeared on Apple's developer news page on October 2. Apple explains that most macOS privacy protections can be sidestepped by Full Disk Access, which exists so backup apps can work properly, and that some developers use the permission in ways that could put users at risk, exposing files, mail, messages and even browsing history. For communication apps, it adds, that can also expose the privacy of the people a user is talking to.

The key sentence promises a change: "we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action." Apple says the risks will grow substantially as AI agents become more capable and autonomous, and that it wants users to understand them before granting such access.

Why AI agents are the trigger

Full Disk Access has long been something power users grant to a few trusted tools. An agent that can read mail, messages and documents, and then act on them, becomes far more useful with broad access, and far more dangerous if it is wrong, compromised or manipulated. MacRumors names Meta's Muse and OpenAI's Dots as examples of the kind of product in view, though Apple's text names no company.

The timing followed a privacy dispute: journalist Jason Aten said Meta's Muse agent synced more than 187,000 rows of his private messages, an account Meta disputes (Daring Fireball, MediaPost). US regulators have also opened an inquiry into the risks of AI agents.

The counterpoint

MacStories, in a piece by John Voorhees, disputes the idea that the permission is mainly used by backup software, listing apps that hold it for other reasons, including Alfred, PopClip and Hazel, as well as some of Apple's own apps. MacRumors cites backup tools such as Carbon Copy Cloner and SuperDuper as legitimate users. MacStories also warns that the wording could signal plans to restrict which kinds of apps can request the permission, while accepting that agents pose real risks without sensible limits.

What is not known

Question	Answer so far
Which macOS version	Not announced
When	Not announced
Mechanism	Not described (extra confirmation, password, periodic reminder or app-type limits are all possible)
Apps affected	Not named
Existing grants	Not said whether they carry over

For ordinary Mac users, nothing changes today. Anyone who has granted Full Disk Access can see the list in System Settings under Privacy and Security, and it is worth checking that each entry is something you still use and trust.

Who is affected

Developers of backup tools, launchers, automation utilities and security software are the most exposed, since many depend on broad file access. Makers of AI assistants and agent products will also feel it, because they are likely to be asked to justify the access they request. Announcing the policy ahead of any code gives them time to adapt, though without a timeline it is hard to plan. The change will apply to Mac users everywhere.

What to watch next

Watch for a macOS beta that shows the new controls, developer documentation setting out what apps must do, and whether Apple applies similar limits to other sensitive permissions agents could use, such as accessibility and screen recording.

Related on Gadgets365

• Meta open-sources its Muse Gadgets kit
• FTC opens its first US probe into AI agent risks
• Windows 11 gets AI agent containers