Apple tightens macOS Full Disk Access over AI agent risk

Apple says it will add new controls around macOS Full Disk Access because AI agents make the permission more dangerous, TechCrunch reports. Full Disk Access was built so backup tools could work. Now desktop agents ask for it too. Apple's message is plain: an app that can read everything, driven by a model that acts on its own, is a different risk than a backup utility.

What actually happened

In a statement reported by TechCrunch and Engadget:

• The problem, in Apple's words: some developers use Full Disk Access in ways that expose files, mail, messages and browsing history "without users' full knowledge and understanding."
• The change: users who want to grant this access will be able to do it only with "very explicit user action."
• The reason: Apple said the risks of this level of access will grow substantially as AI agents get more capable and autonomous.
• The trigger: the statement came days after a journalist claimed Meta's Muse app on Mac read their private messages (Meta disputes the claim), and after a Wired report on a flaw in ChatGPT's Mac app.

Apple did not give a date, a macOS version, or what the new prompt will look like. Treat this as a direction, not a shipped feature.

Why Full Disk Access matters for your business

Your staff Macs probably already granted it. One click in System Settings, months ago, to make an agent "work better." That grant stays until someone removes it. Open System Settings → Privacy & Security → Full Disk Access on every company Mac and read the list. Anything you cannot explain, switch off.

A desktop agent with full disk access holds your inbox. Mail, Messages, Safari history and every downloaded invoice sit on that disk. If the agent gets prompt-injected by a web page, it reads with your permissions. We covered the same trade-off when Muse's agent VM held users' email.

Give agents a folder, not the disk. Most agent work needs one project folder. Grant Files and Folders access to that folder. Keep finance and customer exports out of it.

Expect setup flows to break. When Apple ships the stricter prompt, tools that silently depended on full access will fail or nag. Know which ones you run before that happens.

Sources: TechCrunch, Engadget.