Apple will require explicit user action for macOS Full Disk Access over AI agent risks

Apple tightens a sweeping macOS permission

Apple is moving to restrict one of the most powerful permissions on macOS. In a developer notice published on October 2, the company said it will introduce additional controls around Full Disk Access so that the permission can only be granted through deliberate, unambiguous user action, with users made aware of the risks before they agree.

The Verge reported the change, noting that TechCrunch covered it first, and frames it as a response to a new category of threat: autonomous AI agents that can read and act on a user's system with far less oversight than conventional software.

What Full Disk Access actually grants

Full Disk Access is a macOS setting that, as the name suggests, hands an app the run of a user's machine. According to Apple's own notice, the setting "largely sidesteps" the platform's usual privacy protections, and it exists mainly so backup software can do its job on the Mac.

The company says some developers are leaning on that bypass in ways that endanger users, exposing files, email, messages and browsing history without people fully understanding what they agreed to. For communication apps, Apple adds, the overreach also affects the privacy of the people on the other end of those conversations.

The incident hanging over the announcement

The timing points to a recent controversy. As The Verge recounts, Jason Aten of Inc. reported that Meta's Muse AI appeared to know the contents of his messages even though he had never explicitly given the chatbot permission to read them on his iPhone or Mac.

Meta spokesperson Andy Stone disputed that account, telling the publication that access to Messages is entirely opt-in and requires enabling both Full Disk Access and a Messages connector. Whatever the exact sequence of settings involved, the episode shows how a permission designed for backup tools can end up feeding personal data into an AI product — and how opaque that flow can look even to a tech journalist paying close attention.

What changes, and when

Details are thin. Apple says it will add controls so that only users who genuinely want to grant this level of access can do so, and only through what the company calls "very explicit user action." The notice does not describe the mechanics of the new gating — whether that means re-authentication, more granular prompts, shorter-lived grants or something else entirely — and it gives no timeline for when the changes will ship.

The Verge adds that Apple did not respond to a request for comment beyond the notice itself.

Why it matters

Apple is explicitly tying this crackdown to AI. The company argues that as agents grow more capable and act with less human supervision, the danger of handing any single app blanket read access to a machine will climb sharply. That makes this a rare case of a platform owner re-architecting a long-standing permission model specifically because of agentic software.

The blast radius cuts in several directions. Backup, sync and recovery tools built around Full Disk Access may face new friction during onboarding or after updates. Messaging and email apps that ingest conversation data for AI features will draw sharper scrutiny, since their grants expose other people's data as well. And developers of AI clients and connectors will have to work within prompts designed to make users pause before consenting.

For developers, the practical takeaway is to audit where Full Disk Access is genuinely necessary and migrate to narrower, purpose-built APIs wherever possible. For everyone else, it is a signal that the industry is beginning to treat an AI agent with read access to everything on your disk as a problem to be engineered away, not a feature to be shipped.