Apple Tightens macOS Full Disk Access Rules as AI Agents Raise New Privacy Risks

Apple will add new controls to macOS Full Disk Access, a permission that gives applications unusually broad access to a Mac’s files and protected data. The company said users will need to take “very explicit” action before granting that level of access, responding to risks created by increasingly capable AI agents.

Full Disk Access was built largely to let backup and system-management tools work around macOS privacy protections. Apple’s developer announcement said some developers are using the permission in ways that can expose everything on a system, including sensitive personal information. The company has not disclosed a release date or described the final permission flow.

AI agents raise the stakes because they can inspect, interpret, and act on large collections of personal data rather than simply open individual files. With Full Disk Access, an agent-enabled app could reach messages, email, documents, and browsing history, creating a concentrated privacy risk if its permissions, behavior, or data handling are misunderstood.

The announcement followed concern over Meta’s Muse app on Mac. A journalist said Muse read private messages without clear permission, while Meta disputed the account and argued that Full Disk Access alone was not sufficient to explain the behavior. Apple’s response places the episode within a broader concern about third-party software receiving expansive access as AI tools become more autonomous.

Full Disk Access sits outside many of macOS’s ordinary privacy boundaries, which makes it useful for backup software but difficult for users to evaluate. A single approval can grant an application access across multiple categories of information, while an AI agent can turn that access into searches, summaries, classifications, or automated actions.

Apple’s planned changes address the consent step rather than announcing a new limit on every individual file or database. The wording points to a more deliberate approval experience, giving users a clearer signal that an application is requesting system-wide visibility. The exact safeguards remain undisclosed, including whether Apple will add narrower permissions, recurring prompts, or clearer explanations of an app’s intended use.

Mac developers that depend on Full Disk Access will face closer scrutiny of how their applications request and use the permission. Backup utilities have a longstanding functional reason to need broad access, while general-purpose AI products face a harder explanation: users must understand why an agent needs to inspect private content and what happens after that data is processed.

The change also raises product-design questions for developers building local agents, automation tools, and productivity software. Permission prompts will carry more weight, and unclear requests can damage adoption even when an application has a legitimate use. Developers will need to test their approval flows against Apple’s eventual rules and separate essential access from convenience features.

Apple’s move increases pressure on companies that place autonomous AI tools directly on personal computers. Meta’s Muse controversy supplied the immediate backdrop, while OpenAI’s Dots and other always-on agents have helped make persistent access a visible product category. The issue extends beyond one app because users often cannot distinguish a model’s capabilities from the operating system permissions surrounding it.

For Apple, the decision balances privacy messaging against the practical needs of software that manages an entire Mac. For AI companies, it makes permission transparency part of the product rather than a technical footnote. The episode also fits a wider Mac security pattern, where malware, beta software, and data-stealing tools have kept attention on how much information applications can reach.

Apple’s next step is to publish the implementation details and bring the new Full Disk Access controls into macOS. Until then, users should treat any request for the permission as access to the contents of the computer, not as a routine setting for a single feature.

The outcome will depend on whether Apple’s redesign gives users meaningful choices or simply adds another confirmation screen. A narrower permission model would change how backup tools and AI agents are built; a clearer warning would still improve consent without removing the underlying access. Apple has identified the problem, but the value of the response will be measured by the controls users actually receive.