Apple tightens Full Disk Access over AI agents

Apple said on October 2, 2026 that it will add stronger controls around macOS Full Disk Access because AI agents have raised the stakes of that sweeping permission. In a short developer note, the company said apps that get Full Disk Access can reach files, Mail, Messages, and browsing history — and that some developers are using it in ways users may not fully understand.

What Apple said about Full Disk Access

Full Disk Access sits in System Settings and was built so backup apps can work properly on the Mac. Apple says the permission largely sidesteps the finer privacy controls that normally fence off Mail, Messages, files, and similar data. That breadth is useful for legitimate tools — and risky when an always-on agent can read far more than a user thinks they shared.

"Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users' full knowledge and understanding," Apple wrote. For communication apps, it added, that exposure can also compromise the privacy of people the user is talking to.

Going forward, Apple said it will introduce additional controls so that users who "genuinely wish to grant an app this extraordinary level of access" can only do so with "very explicit user action." The company framed the change as critical because AI agents are becoming more capable and autonomous, and "the risks associated with this level of access will grow substantially."

Why this lands now

Apple's note does not name a product. It arrives in the same week that desktop AI agents — including Meta's Muse and OpenAI's Dots — are under a sharper privacy spotlight. Days earlier, Inc. columnist Jason Aten reported that Muse appeared to know the content of his private messages. Meta disputed that framing. Communications VP Andy Stone said Messages access in the Muse Mac app is opt-in and requires both Full Disk Access and the Messages connector before Muse can read Messages content.

That dispute is exactly the kind of edge case Apple is pointing at: Full Disk Access is a system-level switch that can unlock a lot of personal data, and agent apps increasingly ask for it. Apple is not accusing any one company in the post. It is saying the permission model itself needs a harder stop before users grant "extraordinary" access.

What changes for Mac users and developers

Apple shared no UI mockups, no macOS version target, and no ship date. TechCrunch, MacRumors, 9to5Mac, and The Verge all report the same core facts from the developer post: more controls, very explicit user action, AI agents as the stated risk driver, and no timeline.

Until those controls land, the practical advice is unchanged. Treat Full Disk Access as a last-resort toggle. Prefer agents that ask for narrower permissions. If you already granted Full Disk Access to an AI app, review System Settings → Privacy & Security → Full Disk Access and remove anything you do not actively need. Backup and disk utilities remain the classic legitimate users of this permission.

How this fits the wider agent-safety push

Platform owners are racing to put guardrails around agents that can read, click, buy, and message. NVIDIA's Open Agent Safety Platform ships sandboxing outside the model. OpenAI's DevDay pushed always-on Dots agents into the mainstream. Apple's move is narrower and more OS-native: raise the cost of the single macOS permission that can see almost everything on the disk.

For Apple, the message to developers is clear even without a ship date: do not lean on Full Disk Access as a shortcut for agent features that should use tighter APIs. For users, the promise is a louder, harder-to-miss consent step before any app — backup tool or AI agent — gets that level of reach.

What to watch next

Watch for the change in a future macOS beta, updated Human Interface Guidelines, or a follow-up developer document that spells out the new "explicit user action" steps. Apple did not say whether existing Full Disk Access grants will be reset, re-prompted, or left alone. Until then, the policy signal matters as much as the code: Apple is putting AI agents at the center of how it thinks about one of macOS's most powerful privacy toggles.