Apple Is Tightening macOS Full Disk Access Because of AI Agents

On 2 October 2026 Apple posted a short note on its developer news site titled Updates to Full Disk Access in macOS. It's only two paragraphs long, but it's one of the clearest signals yet that platform vendors are starting to treat AI agents as a new class of risk rather than just another app.

What Apple actually said

Full Disk Access (FDA) is the macOS privacy permission that lets an app read almost everything on your Mac. Apple's own description is blunt: FDA "largely sidesteps" the normal privacy controls "in order to allow backup apps to function properly on the Mac."

The problem, according to Apple, is that "some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users' full knowledge and understanding." It also points out that for communication apps this can "compromise the privacy of the people users are communicating with", which is a fair point: your messages database holds other people's words too.

Apple's fix is to "introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action." And the reason it gives is the part worth underlining: "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."

What Apple didn't say matters too. There's no timeline, no macOS version number and no description of what the new controls will look like. TechCrunch also corrected its own coverage to make clear this is about informed consent rather than a new limit on what FDA can do. So for now, nothing on your Mac has changed. You still control this setting yourself.

Why now

Apple didn't name any app or developer. But the timing lines up with a very public row over Meta's Muse AI agent. Days earlier, Inc. columnist Jason Aten reported that Muse knew the content of his private messages even though he believed he hadn't given it access, and Meta disputed that account (I've written up the Muse story separately).

Ars Technica's Dan Goodin connected the dots. He quoted macOS security researcher Patrick Wardle, who explained that with FDA "any (non-root file), is readable, browsing history, browser cookies, chats, etc etc etc." Ars also noted that Apple's announcement came 11 days after Wardle disclosed a Muse configuration issue that could let other code running on the Mac take control of the assistant, and after Amazon blocked Muse from its platform. TechCrunch separately mentioned a Wired report about a flaw in ChatGPT's Mac app that could have exposed sensitive data.

The common thread: an AI agent with FDA is not like a backup app with FDA. A backup app reads your files and copies them somewhere. An agent reads your files, decides what to do with them, and may be steered by whatever text it reads along the way, including text written by strangers.

Full Disk Access is not full disk encryption

Quick terminology note, because the names are confusingly close. Full Disk *Access* is a permission that decides which apps can read your data while the Mac is unlocked and running. Full disk *encryption* (FileVault on a Mac, LUKS on Linux) protects data at rest when the machine is off or stolen. You want both, and one does nothing for the other. If you're curious about the Linux side, my guide to full disk encryption with LUKS and TPM2 covers it.

Audit your Mac in five minutes

You don't need to wait for Apple's new controls to tighten things up.

1. Open System Settings > Privacy & Security > Full Disk Access.
2. Go through the list. For each app with the toggle on, ask: does this app genuinely need to read everything I own? Backup tools and some security tools do. Most other apps don't.
3. Turn off anything you don't recognise, don't use any more, or don't remember approving. AI assistants and agents deserve the hardest look.
4. Check your terminal apps. If Terminal, iTerm or another terminal has FDA, command-line tools you launch from it generally run with the terminal's permissions. That increasingly includes AI coding agents and CLIs. Consider leaving FDA off for the terminal and turning it on only for the task that needs it.
5. While you're there, look at Accessibility, Screen & System Audio Recording and Automation. Agents that can see your screen or click for you are powerful in a different way.

If an app breaks after you remove access, it will usually tell you, and you can switch it back on deliberately. That's exactly the "explicit user action" Apple is talking about.

The bigger picture

For years, desktop permission prompts were mostly about stopping malware and nosy apps. Agents change the maths. An agent with broad access can be helpful precisely because it reads everything, and dangerous for the same reason, since its behaviour can be influenced by content it reads (prompt injection) as well as by bugs. Expect Windows, Android and the Linux desktops to face the same question. The best defence today is the boring one: give an agent the narrowest access that does the job, and review it regularly.

Watch the 60-second version

This story is also on Riff's AI Headlines, a YouTube channel covering AI and cybersecurity news in short, sourced clips. Subscribe to Riff's AI Headlines on YouTube for daily updates.