Apple Moves to Strengthen macOS Full Disk Access Rules for AI Agents
Apple is preparing to strengthen security protections around Full Disk Access (FDA) in macOS following growing concerns about the amount of sensitive information artificial intelligence agents can access when given broad system permissions.
The company said some developers are currently using Full Disk Access in ways that could expose highly sensitive information stored on Mac computers, including files, emails, messages and browsing history.
Apple warned that the issue could extend beyond the privacy of the individual user. When an application has access to communication data, it may also gain access to information belonging to people communicating with that user.
Full Disk Access is a macOS privacy setting that allows users to decide which applications can access large portions of their system and data. The feature can be found under Privacy & Security in macOS Settings.
Apple introduced the control with macOS Mojave, giving users greater visibility and control over applications requesting access to protected information.
When permission is granted, an application can bypass certain restrictions that normally prevent it from reading or modifying protected files and data.
Such access can be legitimate and necessary for some applications. Security software, backup tools and other system utilities may require broad permissions to perform their functions.
However, Apple is now concerned that the growing capabilities of AI agents are changing the risk associated with granting such privileges.
The company said it intends to update Full Disk Access so that this level of access can only be granted following a clear and deliberate action by the user.
Apple has not yet provided a specific date for when the new controls will become available.
AI agents create a new security challenge
The growing use of AI agents has introduced a different type of security concern for operating-system developers.
Unlike traditional applications that generally perform predefined tasks, modern AI agents can interpret instructions, interact with files, execute actions and connect to external services.
Giving such systems broad access can therefore create significant privacy and security implications.
Apple said the risks are expected to increase as AI agents become more capable and autonomous.
The company wants users to better understand what they are authorising before granting applications access to highly sensitive areas of their devices.
The move reflects a wider industry debate over how much authority AI assistants should have over users’ personal information and computer systems.
An AI agent that can read documents, access messages, interact with applications and perform actions on behalf of a user may be significantly more useful than a conventional chatbot.
But those same capabilities can increase the consequences of a security failure.
Concerns raised over Meta’s Muse
Although Apple did not identify a particular application as the reason for its announcement, the timing has drawn attention to recent concerns surrounding Meta’s Muse AI agent.
Muse is designed as a personal AI agent capable of interacting with a user’s digital environment.
Reports previously highlighted how the tool could access private iMessages on a Mac after a user granted it Full Disk Access.
Meta subsequently clarified that access to private Messages content requires two separate permissions.
The user must grant Muse Full Disk Access at the macOS level and also enable the Messages connector within Muse.
Meta’s chief technology officer, David Singleton, said the Messages integration is opt-in and that Muse cannot read Messages content unless both permissions have been enabled.
The clarification highlights an important issue in the debate: even when access is technically authorised, users may not fully understand how much information an AI agent can potentially reach after receiving broad operating-system privileges.
Security researchers uncover additional concerns
Apple’s announcement also follows security research into vulnerabilities affecting AI applications running on Macs.
Security researcher Patrick Wardle previously demonstrated a proof-of-concept exploit involving Meta’s Muse Mac application.
The vulnerability, referred to as “not-a-mused,” reportedly allowed a local application or terminal command to obtain an authentication token associated with a user’s Muse account.
The vulnerability has since been patched.
Wardle warned that the flaw could allow an unprivileged local process to interfere with Muse’s dictation functionality and potentially abuse the trust and access already granted to the application.
The concern is particularly significant because an AI agent with broad system permissions may have considerably greater access than a conventional application.
If attackers can compromise such an application, they may be able to use its existing permissions to reach information that would otherwise be protected.
How AI agents can expand the attack surface
AI agents are becoming increasingly integrated with operating-system features and third-party services.
Depending on their design and the permissions granted to them, these systems can interact with files, microphones, cameras, calendars, email accounts and other applications.
They may also execute commands or create and modify files.
Each additional capability can increase the potential attack surface.
For example, an AI assistant with access to a user’s messages may be able to process highly personal conversations.
An agent with access to files could potentially encounter confidential documents.
Access to a microphone or camera introduces another category of privacy concerns, while calendar and email permissions could allow an AI system to perform actions with real-world consequences.
The central security question therefore becomes not simply whether an AI application is trustworthy, but whether it should have access to every resource that the operating system makes available to it.
Other AI applications have faced similar scrutiny
The security concerns surrounding agentic AI extend beyond Muse.
Wardle has also reported a vulnerability affecting OpenAI’s ChatGPT application for Mac.
The issue, tracked as CVE-2026-100754, could potentially have allowed attackers to take control of the AI assistant and gain unauthorised access to chat logs and other information stored by the application.
The vulnerability highlights the broader challenge facing developers of AI applications.
Traditional desktop software generally operates within relatively predictable boundaries. Agentic applications, by contrast, may need access to numerous parts of a user’s system to deliver their promised functionality.
This creates a difficult balance between convenience and security.
Restricting access too heavily could reduce the usefulness of an AI agent.
Granting excessive privileges, however, could create opportunities for malicious applications, compromised software or other attackers to abuse those permissions.
Why Full Disk Access matters
Full Disk Access is particularly sensitive because it can provide applications with access to information that would otherwise be restricted by macOS privacy protections.
A user may reasonably understand that an application needs access to a specific folder or document.
However, granting broad system access can be substantially different.
Once permission is granted, the application may be able to access data from several different sources.
That makes the permission especially important when it is requested by an AI-powered application capable of processing and acting on information.
Apple’s planned changes appear intended to make the decision more deliberate.
Instead of allowing broad access to become an overlooked setting, the company wants users to clearly understand the implications before approving it.
The security risks could grow as agents become more autonomous
The capabilities of AI agents are advancing rapidly.
Today’s agents can already interact with applications, interpret information and perform multi-step tasks.
Future systems are expected to operate with even greater autonomy.
As their capabilities expand, so too could the consequences of granting them excessive permissions.
An agent that can independently read files, send messages, execute commands and interact with external services could potentially become a powerful tool for an attacker if its security controls are compromised.
The issue is therefore not limited to the AI model itself.
The surrounding software, authentication mechanisms, operating-system permissions, connectors and external services all become part of the security equation.
A vulnerability in any one of these components could potentially provide a pathway to sensitive information.
Apple seeks stronger user control
Apple’s planned changes indicate that the company wants to place greater emphasis on explicit user consent when applications request broad access.
The approach could make it more difficult for applications to obtain sensitive privileges without users fully understanding what they are approving.
It also reflects a broader shift in cybersecurity thinking around AI.
Traditional permission models were designed for applications with relatively predictable behaviour.
Agentic AI introduces systems that can make decisions, execute actions and interact with multiple services based on instructions.
That difference may require operating systems to rethink how permissions are presented and enforced.
Users will need to understand not only what an application can access, but also what an AI agent can potentially do with that access.
A growing security lesson for AI users
The developments surrounding Full Disk Access, Muse and other AI applications highlight a broader lesson for users and organisations adopting agentic technology.
Convenience should not automatically translate into unrestricted access.
Users should carefully examine the permissions requested by AI applications and consider whether those permissions are genuinely necessary.
Organisations should similarly evaluate AI tools before deploying them across employee devices, particularly when those tools can access sensitive corporate information.
Security teams may need to establish policies governing which AI applications can access files, communications, credentials and other protected resources.
They should also monitor how those permissions are used and review them periodically.
As AI agents become more capable, permission management will become an increasingly important part of cybersecurity.
The technology promises major productivity gains, but those benefits must be balanced against the possibility that a compromised or poorly secured agent could become a gateway to sensitive information.
Apple’s planned changes to Full Disk Access represent one response to this emerging challenge.
The company is effectively signalling that the security model surrounding AI agents cannot remain static while the capabilities of those agents continue to expand.
The future of AI security will likely depend on more granular permissions, clearer user consent, stronger isolation and continuous monitoring.
For Mac users, the immediate lesson is simple: granting an AI application broad system access should be treated as a significant security decision rather than an ordinary setup step.
For developers, the challenge is equally clear. AI agents should request only the permissions they genuinely need and should protect the information and credentials available to them.
As AI becomes more deeply integrated into operating systems, the boundary between an assistant and a highly privileged software agent will continue to become less distinct.
That makes access control more important than ever.
Apple’s decision to tighten Full Disk Access controls shows that the company recognises the changing threat landscape.
As AI agents gain greater autonomy and access to sensitive information, operating systems will increasingly need to ensure that users remain firmly in control of what those systems are allowed to see and do.