Apple tightens macOS Full Disk Access as AI agents raise the risk

Apple tightens macOS Full Disk Access as AI agents raise the risk

by

On 2 October 2026 Apple announced it will add new controls to Full Disk Access (FDA) on macOS, the system-level permission that lets an app read essentially everything on a Mac — files, Mail, Messages and browsing history. Apple’s stated reason is that increasingly capable, autonomous AI agents make that level of access substantially riskier.

What happened

In a developer news post titled “Updates to Full Disk Access in macOS”, Apple wrote:

> Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding.

Apple said it will “introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action”, adding:

> As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.

Apple’s post did not name any app or developer. It followed a public dispute over Meta’s general-purpose agent Muse: a columnist reported that Muse surfaced content from a private Messages thread, and macOS security researcher Patrick Wardle argued that any non-root app holding FDA can read messages, browser cookies and history. Meta’s position was that Muse’s Messages integration is opt-in and requires both FDA and a Messages connector. Apple’s statement came shortly after Amazon blocked Muse from its store on disclosure grounds.

Why it matters for KYA

Full Disk Access is the opposite of a scoped credential: it is a single, coarse grant that bypasses macOS’s usual per-capability privacy prompts (TCC). That was tolerable when FDA was mostly a superuser convenience for backup utilities. It is harder to justify when the same app is an always-on agent that can read, summarise and act on a person’s mail, messages and history.

For an organisation applying principal, permissions and trust history of an autonomous AI agent before it acts.”>Know Your Agent, Apple’s move is a reminder that agent permissioning has to be explicit, scoped and revocable at the platform layer — not delegated wholesale to a capable assistant. The practical questions are the KYA ones: which agents on this machine hold broad access, on whose authority, for what task, and how do you withdraw it? Two defaults follow from Apple’s framing: prefer per-resource grants over FDA, and require a deliberate, informed human action before an agent is handed the keys.

This is a platform-vendor change, not a standard. It governs macOS only, and Apple has not published the exact mechanics or a ship date.

Sources

Know Your Agent (KYA) explains agent identity, verification and accountability. This is an explainer, not legal or compliance advice — see our Sources & methodology. New to KYA? Start with What is Know Your Agent? and the glossary.