Apple
Apple Says It Will Add New Controls to Full Disk Access Because of AI Agents. It Named No Version, No Date and No Developer
Apple told developers on October 2 that it will require "very explicit user action" before an app can be granted Full Disk Access, the one macOS permission that bypasses the system's per-item privacy prompts entirely. The note names AI agents as the reason — and promises a harder door rather than a smaller one.
MAI
Apple published a note to developers on October 2 — fewer than 200 words, no version number, no date, no API — saying it will add controls to Full Disk Access, the macOS permission that lets an app read everything on a Mac. What it did give was a reason, and the reason is AI agents.
Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users' full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.
That is not a release note. It is a warning shot, and it landed days after a public argument about one specific agent.
The one permission that works by exception
macOS normally asks about data in pieces. An app that wants your Documents folder, your contacts, your camera or your screen gets a separate prompt for each, recorded in the system's privacy database, revocable item by item. Full Disk Access is the exception to that design: a single switch in System Settings that hands an app the protected data the per-item prompts exist to guard. Apple introduced it with macOS Mojave in 2018, and its stated purpose was narrow — backup software cannot back up a disk it is not allowed to read.
| Data Apple names in its note | How macOS normally governs it | With Full Disk Access |
|---|---|---|
| Files across the user's volume | Per-folder consent prompts | Readable |
| Protected app data | Readable | |
| Messages | Protected app data | Readable |
| Browsing history | Protected app data | Readable |
The design held for seven years because the population of apps requesting it was small and boring: backup tools, disk utilities, endpoint security agents. An agent that reads your mail, drafts replies, searches your files and acts while you are away wants exactly the same switch, for reasons that are not boring at all.
What happened four days earlier
On September 28, Inc. columnist Jason Aten reported that Meta's Muse agent had synced his Messages database on a Mac mini — to a specific row number — after he declined message access during setup, with Full Disk Access showing as off. Muse, asked how it knew the contents, told him it had only seen notification banners.
Meta disputed the account. Communications chief Andy Stone said the integration is "entirely opt-in," requiring both Full Disk Access and Muse's Messages connector:
It can't read your Messages unless you do this. And it can be revoked at any time.
David Singleton, who runs Meta's Superintelligence Labs, conceded the agent's notification explanation was wrong, and said reading Messages takes three separate permission steps and that "macOS protections can't be bypassed even if the Muse app had a bug."
Both sides may be right about their own half. Meta's position is that the gate cannot open unless the user opens it; Aten's is that he did not open it. Nobody outside either party can settle that, and that is the point: the permission is a single boolean with no log a user can read, no scope and no expiry. When an agent behaves as though it has access, its owner has no way to prove it does not.
Apple's note does not mention Meta, and it does not have to. Engadget notes that agent desktop clients including OpenClaw and Dots routinely ask for the same switch, and that some users have resorted to running agents on dedicated Macs.
Friction is not scope
Read closely, Apple is promising a harder door, not a smaller one. The commitment is to "additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action" — more deliberate consent, better-informed consent. It is not a scoped permission that an agent could request instead.
That gap matters, because the reason a backup tool and an autonomous agent ask for the identical switch is that macOS offers no middle term: no "read my mail but not my browsing history," no grant that expires in an hour, no per-session access an agent must re-earn. Until there is, every extra dialog raises the cost of saying yes without changing what yes conveys. A user who clicks through three warnings has still handed over everything — including the other half of every conversation they have had.
macOS 27 Golden Gate shipped on September 14 and reached 27.0.1 on September 28, so 27.1 is the obvious vehicle; Apple named neither it nor anything else. The test when the change lands is which kind it is. A louder dialog tells agent developers that Apple noticed. A new, narrower entitlement — one that lets an agent ask for less and makes asking for everything conspicuous — would tell them the switch they have been relying on is being taken away.
In the meantime the only control that exists is the one that already existed. System Settings, Privacy & Security, Full Disk Access: the list of apps holding the key is there, and so is the switch to take it back.
Sources: Apple Developer: Updates to Full Disk Access in macOS · TechCrunch: Apple says it's tightening macOS 'Full Disk Access' controls due to new risks from AI agents · AppleInsider: Apple moves to protect private Mac data from overreaching AI apps · Engadget: Apple sounds the alarm on AI agents and 'Full Disk Access' · Decrypt: Meta pushes back on claim that Muse AI read a user's messages without consent · AppleInsider: Meta Muse AI reportedly read Mac Messages without consent · Eclectic Light: Explainer — permissions, privacy and TCC · MacRumors: Apple releases macOS Golden Gate 27.0.1