Apple Tightens macOS Full Disk Access as AI Agent Risks Grow

Apple is tightening controls around macOS Full Disk Access as desktop AI agents gain broader access to users’ files, messages and other sensitive information.

The change follows fresh scrutiny of AI tools that can operate directly on a Mac. An Inc. report about Meta’s Muse claimed the app appeared to know the contents of private messages without the user knowingly granting that specific access. Meta disputed the characterisation.

Separate security concerns have also emerged around other desktop AI software. Wired reported on a flaw in ChatGPT’s Mac app that could have allowed attackers to obtain sensitive information.

Apple warns about broad system permissions

Full Disk Access is a macOS permission originally designed for apps that need unusually broad access, including backup software. When enabled, an app can potentially reach files, mail, messages and browsing history that would otherwise be protected.

That level of access is becoming more consequential as AI agents grow more autonomous. Desktop agents can perform tasks across multiple applications and work with personal information stored throughout a computer, creating greater potential impact if permissions are misunderstood or abused.

In a developer notice, Apple said some developers are using Full Disk Access in ways that could expose information across auser’s system without sufficient understanding of what the permission allows.

Apple said it plans to introduce additional controls so users who genuinely want to grant an app this level of access must take a more explicit action.

AI agents raise the stakes for macOS privacy

The company said stronger safeguards are becoming increasingly important as AI agents gain more capability and independence. An agent with extensive system access could potentially reach far more personal information than a conventional app designed for a narrow task.

Apple’s approach does not eliminate Full Disk Access, which remains useful for legitimate software. Instead, the company is moving toward making the permission harder to grant unintentionally and clearer for users who choose to enable it.

The change reflects a broader security challenge for desktop AI: the more useful an agent becomes through access to private data and system controls, the more important it becomes for users to understand exactly what permissions they are granting.