Apple tightens ‘Full Disk Access’ on the Mac because of AI agents: a week after a claim that Meta’s Muse read private messages, ‘risks will grow substantially’

Apple has announced additional controls around Full Disk Access, the macOS permission that lets an app reach almost all the data on a Mac. In a notice published on its developer site on Friday 2 October, the company said some developers are using the permission in ways that could put users at risk, exposing everything on their systems, including files, mail, messages and even browsing history, without users’ full knowledge and understanding. As AI agents become increasingly capable and autonomous, Apple said, the risks associated with this level of access will grow substantially.

Full Disk Access was designed to let applications such as cloud backup services work properly; on iPhone and iPad no app can access another app’s data by default, but the Mac is more flexible. According to Reuters, the problem grew as desktop AI agents began requesting the permission; according to Engadget, agent apps such as OpenClaw, Dots and Muse often encourage users to grant it. Wired had earlier reported that a flaw in ChatGPT’s Mac app could have allowed attackers to access sensitive data.

The trigger was a dispute over Meta’s Muse agent. Inc. magazine technology columnist Jason Aten wrote that Muse appeared to know the contents of private messages on his Mac even though he had not enabled Full Disk Access; by some accounts, the agent appeared to have synced about 187,000 lines from his Messages database. Meta spokesperson Andy Stone rejected the claim, saying Muse’s access to Messages is entirely opt-in and requires both macOS Full Disk Access and Muse’s separate Messages connector. Apple’s reasoning stands apart from the dispute: it wants this level of access to be granted only through very explicit user action, with users clearly understanding the risks.

Apple did not say when the new controls will arrive or how they will work. The change comes as always-on desktop agents such as Meta’s Muse and OpenAI’s Dots, announced this week, proliferate and perform complex tasks on users’ behalf. For Mac users the practical lesson is that Full Disk Access is closer to root-level trust than a casual setting: granting it to an agent means handing over the keys to files, messages and browsing history.