Apple wants Mac users to think much harder before handing an app the keys to everything on their machine. The company has announced it will add new safeguards around Full Disk Access, the macOS permission that lets software reach past the system’s normal privacy walls, and it is pointing squarely at AI agents as the reason.
Full Disk Access has existed since macOS Mojave in 2018, when Apple expanded its consent framework and needed an escape hatch for tools that legitimately have to see everything. Apple says the permission was largely meant for backup software, which can’t do its job if large parts of the drive are locked away. Today, granting it is as simple as flipping a toggle in System Settings, and once that’s done an app can read mail, messages, documents and browsing history without asking again.
According to Apple, some developers are now leaning on that permission in ways users don’t fully understand. The company also raised a point that rarely gets discussed: when a communication app has this level of access, the privacy of everyone a user talks to is exposed too, not just the person who clicked yes.
Apple’s update, posted to its developer site, says future controls will require very explicit action from anyone who genuinely wants to grant this kind of access, and it warns that the risks will grow as AI agents become more autonomous. That framing isn’t hypothetical. Meta’s Muse agent recently drew criticism over reports that it disregarded user permissions, and OpenAI had to patch a flaw in its ChatGPT Mac app that could have let an attacker manipulate its agent into running malicious commands.
Agents are a particularly awkward fit for a permission like this. A backup tool reads files and copies them somewhere. An agent reads files, interprets them, and then acts, which means anything it can see could become an instruction or a leak. Broad access combined with automated decision-making is exactly the combination security researchers have been warning about.
What Apple hasn’t shared is just as important. There’s no timeline, no description of what the new consent flow will look like, and no indication of whether apps that already hold Full Disk Access will need to request it again. Developers of legitimate backup and security utilities will want answers quickly, since extra friction could hit them as hard as any overreaching AI tool.
It’s also worth noting that Apple is building its own agentic features into its platforms. Whether its first-party tools will face the same hurdles as third-party rivals is a question regulators and competitors are likely to ask.
