Apple is preparing to make Full Disk Access on macOS much harder for apps to obtain, with AI agents appearing to be one of the biggest reasons behind the change.
In a developer update published on October 2, Apple said some developers are using this powerful macOS permission in ways that could put users’ private data at risk. The company warned that Full Disk Access can expose files, emails, messages, browsing history, backups, and other sensitive information if users grant it without fully understanding what the permission allows.
Apple’s message was clear: as AI agents become more capable, more independent, and more deeply integrated into everyday computer use, giving them broad access to an entire Mac becomes a much bigger privacy and security concern.
The company said users will only be able to approve this level of access through “very explicit user action” in the future. Apple has not yet explained exactly what that extra confirmation will look like, but the goal appears to be making sure people know when they are giving an app the keys to nearly everything on their Mac.
Full Disk Access was originally designed for apps that genuinely need deep system visibility, such as backup tools, antivirus software, and certain device management utilities. These apps may need to scan, copy, or protect files across the entire computer.
But the same permission can also allow an app to bypass many of the privacy barriers macOS normally uses to protect specific folders and app data. Once approved, an app may be able to access documents, Mail data, Messages content, Safari information, Home app data, Time Machine backups, and some administrative settings for all users on the Mac.
That level of access becomes especially sensitive when the app is an AI assistant or autonomous agent. Unlike a normal utility that performs a narrow task, an AI agent may be designed to read, summarize, search, click, type, organize, or act on a user’s behalf. If such a tool has access to private conversations, browser history, business documents, or personal files, the privacy stakes rise quickly.
Apple also noted that communication data does not only affect the Mac owner. If an app can access messages or emails, it may also expose information belonging to friends, family members, coworkers, clients, or anyone else the user has communicated with.
The announcement comes amid growing debate around AI agents and how much access they should have to personal computers. One recent controversy involved Meta’s AI agent Muse. A columnist reported that Muse appeared to sync more than 187,000 rows of message history from his Mac, even though he said he had declined access to Messages during setup.
Meta disputed that version of events. Company spokesperson Andy Stone said users must enable both Full Disk Access and the Messages connector before Muse can read any messages. It remains unclear exactly what happened on that specific Mac, but the incident brought new attention to the risks of granting broad system permissions to AI tools.
Other AI agents have also drawn attention for requesting extensive access to a computer. OpenAI’s Dots has been cited as an example of a tool that may ask for broad permissions. ChatGPT’s Mac app can also observe certain user activity on the Mac, depending on the features being used and the permissions granted.
Apple has not announced which macOS version will include the new Full Disk Access safeguards. It has also not provided a release date. The company’s current macOS 27 release does not include the new controls, and for now, Full Disk Access still works through the existing on-off switch in System Settings.
That means Mac users should check their current privacy settings now instead of waiting for Apple’s future changes.
To see which apps have Full Disk Access, open the Apple menu, go to System Settings, choose Privacy & Security, and then select Full Disk Access. Every app with this permission will appear in the list with a switch beside it.
Some apps may legitimately need this permission. Backup software, security tools, and certain system utilities often require deeper access to function correctly. But if an AI assistant appears in that list, it is worth asking whether it truly needs access to your entire Mac.
In many cases, limited access to selected folders may be enough. macOS also offers Files & Folders permissions, which can allow an app to work with specific locations without giving it visibility into everything on the machine.
Turning off Full Disk Access may cause some features in an app to stop working, but it does not uninstall the app. Users can re-enable the permission later if they decide it is necessary.
Mac users should also review two other important permission categories. Accessibility allows apps to control the Mac, including clicking buttons, typing, and interacting with other software. Screen & System Audio Recording allows apps to capture what appears on the screen or record system audio. For AI agents that can operate a computer on behalf of the user, these permissions can be just as sensitive as Full Disk Access.
Apple’s move signals a broader shift in how operating systems may handle AI assistants in the future. As AI tools become more autonomous, users will need clearer warnings, stronger controls, and better visibility into what these apps can see and do.
For now, the safest approach is simple: only grant Full Disk Access to apps you fully trust, remove it from tools that do not clearly need it, and review your privacy settings regularly. On a modern Mac, one permission switch can make the difference between a helpful assistant and an app with access to nearly your entire digital life.
