Apple Tightens Mac Full Disk Access, with AI Agents in Its Sights

On October 3, Apple announced tighter controls on Full Disk Access for the Mac. Privacy controversies around AI agents have, for the first time, forced a platform owner to change its permission policy.

New Prompts: Say Exactly What Before Asking

Full Disk Access is the Mac’s highest permission tier. Apps holding it can read nearly every file on disk: local documents, photos, message history. It was designed for backup software and system utilities. Apple itself admits: “Full Disk Access largely bypasses these controls, intended to let backup apps work properly on the Mac.”

Now a wave of AI agent apps is claiming the same permission. Apple’s statement: “Some developers are using Full Disk Access in ways that may put users at risk, exposing the full contents of their systems without users being adequately informed and understanding.”

The new flow requires users to take “clear, deliberate” action before authorization takes effect. Prompts will specify exactly which parts of the system the app wants — replacing the old blanket “Allow” dialog.

Apple added a warning: “The risks of Full Disk Access will grow substantially as AI agents become more capable and more autonomous.” It specifically flagged that broad data access by communications apps “also endangers the privacy of others the user communicates with.” It’s not just you exposed — your chat partners get dragged in too.

The Trigger: Meta’s Muse

In the spotlight: Meta’s AI agent Muse. Launched September 8, it racked up 5 million US downloads in 22 days and topped the US App Store for 12 straight days. Sensor Tower data: ChatGPT took 56 days to reach 5 million downloads, Grok 103, Claude 492.

Downloads ran fast; complaints followed. Users discovered Muse could read messages they considered private. Its mechanism is Full Disk Access: once granted, Muse can scan your entire disk like backup software.

This isn’t Muse’s first wall. Amazon has already blocked its shopping features over policy and privacy concerns. Meta wanted Muse to be “do everything”; it’s been hitting red lines with platforms and merchants instead.

Behind the downloads is a distribution story. Sensor Tower estimates that in two weeks of September, Muse captured half of Meta’s own ad impressions; in the week of September 21, it ranked in the top 15 for US ad impressions. The Neuron’s verdict was direct: distribution can buy downloads, but it can’t buy trust.

Agents Aren’t Ordinary Apps

A traditional app reads your files one needed piece at a time. An agent that “does things for you” inherently needs deeper system access: canceling subscriptions, organizing files, replying to email — every step can touch private data. When permission design doesn’t keep up, you get the current situation: users thought they authorized “errands”; they actually handed over the whole disk.

This is the first time a platform owner has changed permission policy specifically for AI agents. The announcement gave no timeline or macOS version for the new prompts. But the direction is set: to get Full Disk Access going forward, you’ll have to say exactly what first.

Data protection authorities in multiple jurisdictions are already reviewing AI agent apps that access on-device data. Apple moved first; other platforms will likely follow.

What Regular Users Can Do Now

If you’ve used Muse or other AI agent apps, check now: open System Settings → Privacy & Security → Full Disk Access and look at the list. Every name on it can read your entire disk. Anything unfamiliar, or anything that clearly doesn’t need disk access for its job — turn it off. Once the new prompts ship, read carefully which parts they’re actually asking for.

Developers need a mindset change too. The shortcut of grabbing Full Disk Access to bypass proper APIs is narrowing. Apps that genuinely need it are unaffected; those using it to cut corners will watch the new prompts scare off half their users first.

(Sources: IANS, Nation Press, Sensor Tower via 9to5Mac, The Neuron, Mashable)