Apple tightens Full Disk Access rules on macOS after AI agent concerns

Apple is adding new restrictions to a macOS permission called Full Disk Access, a setting that lets apps read nearly everything on a Mac. The company said in a blog post for developers that the risks of this level of access have grown because AI agents running on the desktop are now capable enough to misuse it.

Full Disk Access already existed to let backup software work properly. It gives an app permission to read files, mail, messages and even browsing history. Apple said some developers have been using that access in ways that could expose everything on a user’s system without the user fully understanding what they were agreeing to.

The change follows a report from Inc. columnist Jason Aten, who wrote that Meta’s Muse app on Mac appeared to know the contents of his private messages even though he said he never gave it permission to see them. Meta disputes that account. Muse offers Full Disk Access as an optional setting, and Apple’s own explanation of the permission shows how much reach it grants once enabled.

Separately, Wired reported a flaw in OpenAI’s ChatGPT app for Mac that could have let hackers reach sensitive data on a user’s system. Apple did not tie its announcement directly to that report, but the timing places both incidents just before the company’s decision to act.

Apple said it will introduce controls meant to make sure that only users who “genuinely wish to grant an app this extraordinary level of access” can do so, and only after “very explicit user action.” The company did not describe the exact mechanics of the new controls, such as what the consent screen will look like or when it will ship.

What Apple is acknowledging

The core of Apple’s statement is an admission that its existing permission system was built for a different kind of software. Full Disk Access was designed with backup tools in mind, not autonomous agents that can read a user’s inbox or chat history and act on it without a person checking each step. Apple wrote that “as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially,” and said it wants users to understand those risks before granting access, not after.

Apple did not respond to TechCrunch’s request for comment beyond the blog post. It is not yet clear which macOS version will carry the new controls, how existing apps with Full Disk Access already granted will be affected, or whether Meta and OpenAI will change their own apps in response. Developers building desktop AI agents for Mac will need to watch for Apple’s next move, since any new consent requirement could change how their apps request access to a user’s files.