On October 2, Apple published a developer news post saying it will add new controls around macOS Full Disk Access, and it named AI agents as the reason. Apple’s framing, in short: the permission exists so things like backup apps can work, it largely sidesteps the privacy controls everywhere else on the system, and as agents become more capable and autonomous the risk of that level of access will grow substantially. Apple says users who truly want to grant it should only be able to do so with “very explicit user action.”
What Full Disk Access actually is: one grant that lets an app read files, mail, messages, and even browsing history. Apple also said some developers are already using it in ways that expose nearly everything on a machine without users fully understanding what they agreed to.
The fine print is the story. Apple gave no date, no macOS version, and no technical detail. And it’s about how the permission is granted, not about restricting what an agent can do once it has it. Some early headlines said Apple was “limiting” access. At least one commentary notes TechCrunch changed its wording to reflect that the direction is informed consent, not a new capability ceiling. A louder headline than the announcement itself.
What set this off: an Inc. columnist, Jason Aten, reported that Meta’s Muse desktop assistant had reached 187,000 rows of his Messages data even though he said he hadn’t given permission. Meta’s spokesperson said access to Messages is entirely opt-in: you grant Full Disk Access and separately enable a Messages connector. Both things can be true. Opt-in by design, and still surprising in practice. That gap is exactly what “very explicit” wording seems to aim at, though that’s my reading, not Apple’s statement. A Wired report about a flaw in ChatGPT’s Mac app was also cited in coverage. As far as I can tell, Muse here is a different product from Muse Code, the terminal agent I covered earlier, though they share a brand.
The wider pattern: always-on desktop agents are arriving from every direction. OpenAI’s dots, Meta’s Muse, and Microsoft’s Autopilot, built on OpenClaw. Every one of them gets more useful the more of your machine it can see, and that’s the entire tension. Apple’s note is the platform owner saying out loud that the default way of granting that visibility doesn’t fit the new situation.
It lands the same week as the FTC investigation and NVIDIA’s safety platform, at a different layer. NVIDIA’s approach enforces a boundary from outside the agent. Apple’s move is the OS owner deciding how hard it should be to hand over the keys in the first place. Same direction, different place in the stack.
What you can do today: open System Settings, then Privacy and Security, then Full Disk Access, and read the list. If you gave a terminal app or an agent app that permission to get something working, ask whether it still needs it. In most cases a coding agent needs your project directory, not your whole disk. And until Apple says what changes and when, treat this as a statement of direction, not a shipped control. Still worth noting that the company that makes the operating system said it plainly.
