3 OCT 2026 — On a Mac, one setting decides whether an app can read nearly everything on the machine. It is called Full Disk Access, and it was built so that backup software could copy every file. Apple said on 2 October that it will add new controls around that setting, because AI agents are making the access it grants far riskier.
The notice came days after a columnist said Meta's Muse agent had read his private messages, a claim Meta disputes.
What Apple said
In a short notice to developers, Apple said Full Disk Access "largely sidesteps" the privacy controls that normally govern what apps can see. Some developers use it in ways that expose "files, mail, messages, and even browsing history" without users fully understanding. For messaging apps, Apple added, that can also compromise the privacy of the people users talk to.
Apple said it will make sure that users who "genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action." Its stated reason: "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."
The dispute that preceded it
Days earlier, the Inc. columnist Jason Aten reported that Muse, Meta's AI agent for the Mac, knew the content of his private messages although he had not given it permission. Meta rejected the claim. Its communications chief, Andy Stone, wrote that the Messages integration is "entirely opt-in" and needs both Full Disk Access and a Messages connector to be switched on, TechCrunch reports.
Another Meta executive, David Singleton, described three separate permission steps, including a confirmation inside macOS Settings and a restart of the app. Aten said Full Disk Access was off when Muse read his messages, and that the agent itself told him it had been syncing his notifications. Singleton said the agent was confused and gave a wrong explanation. The two accounts have not been reconciled.
Why AI agents change the risk
A backup tool copies files and does nothing else with them. An AI agent given the same access can read those files, act on what it finds, and send content to a remote model. That shift is why a setting that was a niche concern for backup tools now sits behind consumer AI products.
This is not the first case. In August, OpenAI released an Apple Messages plugin for ChatGPT on Macs that also required Full Disk Access. Wired has separately reported a flaw in the ChatGPT Mac app that could have let attackers reach sensitive data, according to TechCrunch.
What is not yet known
Apple did not say what the "very explicit user action" will look like, when it will arrive, or whether apps that already hold Full Disk Access will have to ask again. It did not name any developer.
How to check your own Mac
Mac users can check now. The setting is under System Settings, in Privacy & Security, then Full Disk Access, which lists every app that holds it and lets users switch each one off.
View author profile → · Editorial policy
