Apple is changing a Mac permission because of AI agents. It has not said when or how.

Apple named the reason in two paragraphs

On 2 October 2026, Apple posted a short notice to its developer news page titled "Updates to Full Disk Access in macOS." Two paragraphs long, it announces no feature. It announces an intention, and then says out loud why.

"Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action," the post reads. Then the sentence that made it news: "Addressing this is critical. As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."

Apple also said what is already going wrong, in the present tense: "Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems, including files, mail, messages, and even browsing history, without users' full knowledge and understanding." It named no developer and no app.

What Full Disk Access actually is

This matters more than the announcement, because most Mac users have granted it at some point without thinking hard. macOS normally gates an app's reach with per-category permissions: an app asks for your Photos, or your Contacts, or your Documents folder, and you get a prompt for each. Full Disk Access is the override. In Apple's own description, it "largely sidesteps these controls in order to allow backup apps to function properly on the Mac."

It exists because a backup tool genuinely needs to read everything, including the parts of your home folder macOS otherwise protects. It is granted once, in System Settings, with a toggle rather than a prompt at the moment of use. After that the app can read your Messages database, your Mail store and your browser history, and nothing tells you when it does.

That design was reasonable when the software asking was Time Machine or Carbon Copy Cloner. It is a different proposition when the software asking is an always-on assistant that acts on your behalf, decides for itself what to look at, and talks to a server.

The case Apple did not name

Four days before Apple's notice, Inc. columnist Jason Aten published an account of testing Meta's Muse agent on a Mac mini. He says he declined Muse's request for Messages access during setup and left Full Disk Access switched off. He then found that Muse had synced roughly 187,000 lines from his local Messages database, and that Messages access was showing as enabled inside Muse's own settings pane despite his refusal.

When he asked the assistant how it knew the contents of his texts, it told him it was only relaying notification banners: "It's the incoming notification stream only, not access to your texts." Aten's position is simple. "I never gave it permission to do that," he wrote.

Meta disputes the mechanism, firmly and by name. Communications chief Andy Stone said reading Messages requires two separate permissions the user controls, Apple's Full Disk Access and Muse's own Messages connector, either of which can be revoked at any time. David Singleton, an executive at Meta Superintelligence Labs, put it plainly: "The Messages integration in the Muse Mac App is opt-in."

Both things can be true in a way that should worry you more, not less. If Meta is right that two opt-in switches are required, then the open question is how a user who says he flipped neither ended up with 187,000 lines synced and the connector showing as on. If Aten is right, the permission model failed. Nobody has published the technical explanation that would settle it, and Apple's notice carefully declines to adjudicate. We wrote about the hardware side of Meta's agent push when it put its AI on a keychain.

What Apple left out, which is most of it

Read the notice again for what is missing. No date. No macOS version. No description of what the "additional controls" are, whether a per-file prompt, a time-limited grant, a separate entitlement for agent-style apps, or simply a scarier confirmation dialog. No statement on whether existing grants get revoked or grandfathered, which is the detail that decides whether this changes anything for the apps already holding the permission on your machine today.

So treat this as a signal about direction, not a protection you have. Full Disk Access works exactly as it did last week. Any app you have already granted it still reads everything, and will keep doing so until a macOS release actually ships a change.

The part you can act on today

Open System Settings, then Privacy and Security, then Full Disk Access, and read the list. Most people find at least one entry they do not remember adding and one they no longer use. Revoke anything that is not a backup tool, a disk utility or a security product you deliberately installed. An AI assistant is almost never in that category, and the ones that ask for it are precisely the ones where the permission is hardest to reason about, because you cannot predict in advance which files the agent will decide it needs.

If you want the general version of this problem, an agent given broad access tends to find uses for it that nobody specified, which is the same pattern behind OpenAI's own agent failing a safety test days earlier.

Our take

Apple deserves credit for saying the quiet part in a developer notice: the permission model predates the software it is now being asked to contain. It deserves much less credit for shipping a paragraph instead of a control. A commitment with no version number and no mechanism is a press position, and the window between "we will introduce additional controls" and macOS actually enforcing them is exactly when agent vendors are racing to get the toggle flipped. The useful move is not to wait for Apple. It is to go look at your own Full Disk Access list this week, because that list, not Apple's intention, is what decides what an agent on your Mac can read.