Apple Just Rewrote the Mac's Most Powerful Privacy Permission — Because of AI Agents

Apple is rewriting the rules for the most powerful privacy permission on the Mac — and the stated reason, for the first time, is AI agents.

Full Disk Access is the macOS permission that lets a single app read everything: your files, mail, messages, browsing history, Time Machine backups, even admin-level system settings. Apple originally built it so backup software could copy an entire drive. In a developer announcement on October 2, Apple said it will now require "very explicit user action" before anyone can switch it on.

Why now

Apple says "some developers are using Full Disk Access in ways that could put users at risk," exposing everything on a user's system "without users' full knowledge and understanding." Its warning is plain: as "AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."

The trigger was public. Inc. columnist Jason Aten reported that Meta's Muse agent surfaced details from his private Apple Messages — 187,000 rows synced from his Mac's local Messages database — even though he says he declined Messages and calendar access. Meta disputes the account: it says the Messages integration in the Muse Mac app is opt-in and that system protections cannot be bypassed. Separately, Wired documented a recently patched flaw in the ChatGPT Mac app that could have let attackers reach sensitive data.

Apple named no app in its announcement. It didn't have to.

Why it matters

This is the first time a major desktop OS has carved out a separate risk class for AI agents in a core privacy primitive. The permission model was designed for backup software — a narrow use case with an obvious justification. An AI agent asking for the same grant is a different proposition: it reads files, but it also sends things somewhere — a model provider, a vector database, a logging endpoint. Apple's framing also flags the multi-party problem: communication apps expose the people you talk to, so your own consent can't cover the message content of everyone you correspond with.

Developer reaction was split. Some welcomed the prospect of per-folder granularity; others bristled at Apple calling disk access "extraordinary" — one Hacker News commenter noting it used to be the baseline assumption for software running on hardware you own.

The takeaway

Apple hasn't named a macOS version or a date, so developers have no firm compliance timeline. But the direction is clear: expect more friction — clearer consent prompts, narrower scopes, and fewer apps quietly holding the keys to everything.

In the meantime, do one quick audit: open System Settings, search Full Disk Access, and look at which apps currently hold it. Some of them asked once during setup and you clicked through so you could get to the demo. Apple is now betting you'll want a second thought — and it's making the permission itself demand one.