Apple says Mac apps will soon need more explicit user action to gain full disk access because AI agents raise the risks of abuse.
Apple said on Friday that it is changing how "full disk access" works on macOS, adding new limits so that apps can receive that permission only through what the company described as "very explicit user action," as reported by The Verge. Full disk access is a Mac system permission that gives an app broad access to data stored across the machine.
The company tied the change directly to AI agents. In Apple's wording, some developers are using full disk access in ways that could expose "files, mail, messages, and even browsing history" without users' full understanding, and the risks "will grow substantially" as AI agents become more capable and autonomous, according to Ars Technica.
What Apple is changing
Apple has not said when the update will roll out, but it has said the goal is to make sure users who truly want to grant this "extraordinary level of access" can do so only through a more deliberate process, The Verge reported.
In plain English, full disk access is broader than a typical app permission. Apple says it largely sidesteps other privacy controls in macOS so that backup apps can work properly. That means it can be useful for legitimate software, but it also creates a single, sweeping permission that opens much more of a user's stored information if granted.
Apple's own statement was unusually direct about the scope. It said some developers are using the setting in ways that could expose nearly everything on a system, including personal communications and browsing data, Ars Technica wrote. For communication apps, Apple added, the privacy risk can extend beyond the device owner to the people they are talking with.
Why AI agents are part of the issue
Apple's announcement followed public criticism around Meta's Muse assistant. Both source reports say the debate started after Inc columnist Jason Aten said Muse referred to the contents of a thread in Apple Messages even though he believed he had not granted it permission to read those messages. Meta representatives said Messages access was opt-in and required two separate steps: full disk access at the macOS level and a Messages connector inside Muse, according to The Verge and Ars Technica.
Ars Technica says Apple's statement cuts against the idea that full disk access alone is harmless. The report cites macOS security expert Patrick Wardle saying that, from a technical point of view, an app with full disk access can read non-root files such as browsing history, cookies and chats. Ars also notes that Apple did not name Meta or Muse directly, and says it is possible the company was referring more broadly to developers rather than to one incident.
That distinction matters. What is established by the sources is not a formal Apple ruling on Meta's behaviour, but a platform-level response from Apple that treats broad disk access as increasingly risky in the age of autonomous assistants. In effect, Apple is saying that as software takes more actions on a user's behalf, a single permission that opens access to messages, email and local files deserves stronger friction.
What full disk access actually allows
The technical issue here is simpler than the name suggests. Full disk access is not just permission to save or open a document. It can let an app read data across the system that other privacy controls would normally limit, The Verge explained. Apple says that capability exists in large part so backup software can function.
That same design becomes more sensitive when applied to AI assistants. An assistant is meant to pull together information from messages, calendars, email and files so that it can answer questions or take actions. Apple's concern, based on its own statement, is that users may not fully grasp that granting one high-level system permission could expose all of those sources at once, as described by Ars Technica.
Ars also places Apple's move in a broader security context. It says the announcement came 11 days after Wardle disclosed a Muse configuration that allowed any app or code running on a Mac, including commands injected through ClickFix attacks, to take control of the assistant. From there, an attacker could access the same resources Muse could. That does not mean Apple's new limits were a response to that disclosure alone, but it does show why a highly privileged assistant can be attractive to attackers as well as useful to users.
What this could mean for developers and IT teams
The immediate effect is clearest for developers of Mac apps that rely on broad local access, especially assistants and communication tools. If Apple adds more friction to the approval flow, those apps may need to change how they request permissions or explain their behaviour to users. The sources do not describe the exact implementation, so it is not yet clear whether Apple will alter prompts, settings flows, or technical APIs.
For organisations, the issue is less about consumer convenience than endpoint trust. A tool with full disk access can potentially reach into mail, messages, files and browsing history, so IT and security teams may need to scrutinise which automation or assistant tools are allowed on managed Macs. That is a supported implication of Apple's own description of the permission's breadth, though neither source reports specific enterprise policy changes or named company responses.
The sources do, however, show reasons for caution. Ars reports that Amazon blocked Muse from its platform, saying such apps "should operate openly and respect service provider decisions about whether or not to participate." Separately, the same report describes a disclosed configuration issue that could let other code seize control of the assistant. Together, those details suggest that organisations evaluating AI agents on desktops may focus not just on usefulness, but also on how much system access an agent needs and what happens if that agent is compromised.
Why it matters
Apple's announcement is a platform security change, but it also reflects a broader shift in how operating system vendors are treating AI assistants. A permission once justified mainly for backup software looks riskier when the app receiving it is designed to act autonomously and aggregate personal data from many sources.
What is firmly established by the sources is narrow but important: Apple says new controls are coming, it explicitly links them to rising risk from AI agents, and it says users will need to take more explicit action before granting full disk access, according to The Verge. What remains unclear is how those controls will work in practice, when they will arrive, and how much they will constrain current Mac assistants.
The strongest conclusion supported by these reports is that Apple now sees full disk access as a higher-stakes trust decision than before. For users and developers alike, the immediate question is no longer just whether an assistant is useful, but whether it needs this level of access at all.