Apple tightens macOS Full Disk Access, citing the risk from AI agents

Apple is changing how one of macOS’s most powerful permissions can be granted, and it names AI agents as the reason. In a post for developers on October 2, Apple said it will introduce additional controls around Full Disk Access. This article covers what Apple said and left out, the two recent incidents that TechCrunch connects it to, and how to check your own Mac. We read Apple’s post and the reports below; we did not test any app.

What is Full Disk Access on a Mac?

Full Disk Access is a macOS privacy permission. Apple describes it as largely bypassing the controls that normally limit what an app can reach, and says it exists so that backup apps can work properly. An app that holds it can see files, mail, messages and browsing history across the system.

What Apple announced about Full Disk Access

Apple’s post makes four points:

• Full Disk Access “largely sidesteps” the controls macOS normally puts between apps and private data. It exists so that backup apps can work properly.
• Some developers use it in ways that could put users at risk. An app with it can see everything on the system, including files, mail, messages and browsing history, “without users’ full knowledge.” For communication apps, Apple adds, that can also compromise the privacy of the people the user talks to.
• Going forward, Apple will add controls so that people who genuinely want to grant this access can do so only through very explicit user action.
• AI agents are the stated reason: as they become more capable and autonomous, Apple says the risks of this level of access “will grow substantially.”

What Apple left out: no date, no details, no named apps

The post gives no release date and no macOS version, and it does not describe what the new controls look like. It names no app or company, and it does not mention Muse, ChatGPT or any incident. TechCrunch reports that Apple did not respond to its questions. The link to specific incidents is TechCrunch’s framing, not Apple’s.

Meta Muse and ChatGPT: the incidents linked to Apple’s move

Meta’s Muse. Inc. columnist Jason Aten reported that Meta’s Muse agent on Mac knew the content of his private messages, although he says he had not given it permission. We could not open the Inc. article and rely on TechCrunch’s account. Aten said Full Disk Access was off at the time, and that when he asked, Muse said it was syncing his device notifications. Meta disputes the claim. Its communications chief said reading Messages in Muse is opt-in and requires enabling both Full Disk Access and the Messages connector. A Meta Superintelligence Labs executive said the setup involves three separate steps plus macOS’s own protections, and that Muse’s explanation of what happened was wrong. Meta also points to its Muse security page, which describes an isolated environment for the agent and a bug bounty of up to $300,000. The accounts conflict, and nothing we read resolves them.

ChatGPT’s Mac app. WIRED reported a now-patched flaw found by researchers at the Objective-See Foundation. By WIRED’s account, a trusted script-interpreter component could be tricked into passing an attacker’s script to the main ChatGPT process, which could expose chat logs, let an attacker run commands through the app and reach connections such as browser sessions. It could only be exploited by an attacker who already had malware on the machine. OpenAI acknowledged the fix in its change log on September 25. The same researcher told WIRED he had also found a since-patched flaw in Muse’s dictation feature, and that he has reported another issue involving ChatGPT and OpenAI’s Dots assistant, which OpenAI is reviewing.

These are two separate stories. The ChatGPT flaw was about the app’s own protections, not about Full Disk Access as such, and Meta says Muse’s Messages access depends on it.

Why AI agents raise the stakes for Full Disk Access

This part is our reading, not Apple’s. A conventional app that holds Full Disk Access is one program with fixed behavior. An agent decides what to read at run time, from instructions that can include untrusted text such as a web page or an email. We have covered the wider problem of agents that run code and plugins with broad access in DeepSeek Harness and Claude Code mods. Give that agent Full Disk Access and everything that setting exposes is within reach of whatever the agent can be talked into. Apple’s decision to require an explicit action is a response to that shift.

How to check Full Disk Access on your Mac

Apple’s Mac User Guide gives the path: choose Apple menu, System Settings, click Privacy & Security, then Full Disk Access (you may need to scroll). Our suggestions:

• Read the list. Remove anything you do not recognize or no longer use.
• Ask whether an agent really needs it. Many tasks work with access to a single folder.
• Check terminal apps and editors. Tools you launch from them typically run with that app’s access, so a terminal on the list matters if you run coding agents there.
• Keep high-value data away from experiments. A separate macOS user account or a VM for agents you are testing limits the damage, as DeepSeek’s own safety notice also recommends.

What to watch

• The details. Apple has not said when the controls arrive or how they will work, nor whether they apply to existing grants.
• Developer response. Backup and security tools legitimately need this access. Watch for how Apple keeps them working.
• The Muse dispute, including any technical findings from outside researchers.

Editorial review: October 2, 2026 (AI). Prepared from Apple’s developer news post and Mac User Guide, TechCrunch’s reports of September 30 and October 2, WIRED’s report, and Meta’s Muse security page, read the same day. We could not open the Inc. article and relied on TechCrunch’s description of it. We did not test Muse, ChatGPT or any macOS behavior. The cover is an AI-generated illustration supplied by the editor. The “Why AI agents raise the stakes for Full Disk Access” section and the suggestions are ours.