Apple Restricts Mac Full Disk Access Amid AI Agent Risk

Apple will add new limits on "full disk access" permissions for Mac apps, a change the company says responds to risks posed by AI agents, according to The Verge. In a Friday update cited by The Verge, Apple said it is rolling out controls so that users who want to grant an app that level of access "can only do so with very explicit user action."

What exactly is full disk access, and why does it matter?

Full disk access is the broadest file-system permission Apple offers on macOS. A granted app can reach files, mail, messages, and browsing history system-wide, not just the data inside its own sandbox, per Apple's Friday statement reported by The Verge. Apple's own language frames the stakes directly: "Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users' full knowledge and understanding," the company said, according to The Verge.

Why is Apple citing AI agents specifically?

Apple's statement ties the policy change to the rise of autonomous AI agents running on Mac hardware, arguing that software capable of acting on a user's behalf "substantially" raises the risk calculus around sweeping permissions, as described in The Verge's report. The concern is less about a single rogue app reading a file once than about agents that can chain together file access, messaging content, and browsing history into a persistent operational picture of a user's device — without the user tracking each individual grant along the way.

What incident brought this scrutiny to a head?

The policy shift follows a specific episode involving Meta's Muse AI chatbot. Business Insider's Jason Aten reported that Muse somehow knew the contents of his messages despite his not having explicitly authorized the chatbot to read them on his iPhone or Mac, according to The Verge's account of his finding. The timing is notable: Apple's Friday update landed just weeks after that report surfaced, per The Verge.

How did Meta respond to the Muse AI report?

Meta disputed the characterization of its product's access as unauthorized. Spokesperson Andy Stone said access to Messages through Muse is "entirely opt-in," and that a user must separately enable both Full Disk Access and the Messages connector before Muse can read Messages content, as quoted in The Verge's reporting. That two-step requirement — toggling system-level disk access and then a feature-specific connector — is itself a window into how today's permission architecture works on Mac: a user can grant the broad system permission once and then not realize which individual app features are drawing on it later.

Apple's new framing effectively targets that gap. By requiring "very explicit user action" for full disk access specifically, Apple's Friday statement signals it wants the initial grant itself to be harder to make accidentally or without full understanding, rather than relying solely on secondary, feature-level toggles like the Messages connector Meta described.

What does this mean for Mac developers going forward?

The Verge's report, which also credits TechCrunch with earlier coverage of the same Apple update, does not specify a rollout date, a list of affected apps, or the exact mechanics of the new consent flow. What is confirmed, per Apple's own Friday statement as relayed by The Verge, is the policy direction: full disk access moves from a permission users can grant somewhat passively to one gated behind a more deliberate, explicit action. For developers building AI agents or assistants that currently rely on full disk access — to search local files, index messages, or monitor browsing activity on a user's behalf — the practical effect will likely be friction at the permission-request stage, pushing more of them toward narrower, purpose-built entitlements instead of the system-wide grant.

Apple has not published a technical specification for the new consent mechanism, and The Verge's report does not include a timeline for when the change takes effect across macOS. The dispute between Aten's reporting and Meta's on-the-record response — over whether Muse's message access was properly disclosed to the user in the moment, not whether the underlying permission existed — remains unresolved in the public record, with Meta maintaining the access required user-enabled settings and Aten reporting the chatbot appeared to know message contents without his having knowingly granted that specific permission.