macOS Full Disk Access Tightens for AI Agents

On October 2, 2026, Apple told Mac developers that one of the most powerful permissions on a Mac is about to get harder to grant, and it named a reason: AI agents. Full Disk Access has always been one of those prompts, buried a few menus deep, that people grant once to a backup tool or a utility and then forget. Apple now says that habit is a bigger problem when the app asking is an agent that can act on its own. Two days earlier, Meta's Muse agent had been at the center of a public dispute about exactly this kind of access.

This guide covers what Apple actually said, what it left out, the dispute around Meta's Muse that surrounded the announcement, how to check your own Mac in five minutes, and what we still do not know.

What macOS Full Disk Access AI Agents Risk Actually Means

Apple Support describes Full Disk Access in the Privacy & Security settings as a permission that lets apps "access all files on your computer, including data from other apps (for example, Mail, Messages, Safari, and Home), data from Time Machine backups, and certain administrative settings for all users on this Mac."

That is a very large slice of someone's digital life behind one "Allow". It exists for a legitimate reason. In its developer post, Apple says Full Disk Access "largely sidesteps" the normal privacy controls "in order to allow backup apps to function properly on the Mac." Backup software and disk utilities genuinely need to reach everything.

For a conventional app, that risk sits quietly in the background. For an AI agent that can read, decide and act without a person checking each step, the same permission is closer to a master key than to a narrow door. That is the shift Apple is responding to.

What Apple actually said

The announcement is a short developer news post titled "Updates to Full Disk Access in macOS", dated October 2, 2026. Apple wrote that "some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users' full knowledge and understanding." It added that "for communication apps, this can also compromise the privacy of the people users are communicating with."

Then the key sentences: "Going forward, we will introduce additional controls to ensure users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action." And: "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."

Notice what the post does not contain. It names no company and no app. It gives no macOS version, no date and no description of the new controls. MacRumors, reporting the post the same day, noted that Apple did not say when the controls will arrive, and tied the announcement to the rise of always-on agents such as Meta's Muse and OpenAI's Dots. That tie is MacRumors' reading, not Apple's wording.

The dispute around Meta's Muse

Days before Apple's post, a separate story was already circulating. Inc. columnist Jason Aten wrote that Meta's Muse agent had read his private messages on his Mac while Full Disk Access was off. According to TechCrunch's report of September 30, Aten also said that when he asked Muse to explain how it knew, the agent told him it was syncing his "device notifications".

Meta disputed all of it. Meta VP of Communications Andy Stone wrote on X that "the Messages integration in the Muse app for Mac is entirely opt-in", and that users have to enable both Full Disk Access and the Messages connector before Muse can read their messages. David Singleton, an executive at Meta Superintelligence Labs, said reading messages requires "three separate steps of application-level permissions and built-in macOS system-level protections" that "can't be circumvented even if the Muse application had a bug", and that the agent's notification explanation was wrong.

So the facts are genuinely contested. One side says Full Disk Access was off and messages were read anyway. The other says that is impossible without the permission being granted. Apple's post did not mention Meta, and we cannot tell from public information which account is right. Muse was also growing fast, which raised the stakes: our report on Meta Muse's 10 million downloads covers that side.

A second story the same day: the ChatGPT Mac flaw

On October 2, Wired reported on research by the Objective-See Foundation into a flaw in the ChatGPT app for Mac, tracked as CVE-2026-100754. According to coverage of the report, local code running on a Mac could masquerade its commands as requests from trusted OpenAI components, and so make ChatGPT act with its own permissions. The coverage says the impact was limited to local ChatGPT data and resources the app was already authorized to reach, that Wired reports no attacks in the wild, and that OpenAI has patched the flaw.

This is a different problem from the Muse dispute, but it shows the same structural point. Desktop AI assistants sit close to your files and accounts, so a bug or an over-broad permission in one of them matters more than it would in an ordinary app. If you are choosing between assistants for daily work, trust questions like this now matter alongside quality, as our NotebookLM vs ChatGPT comparison explains for another pair of tools.

What we know and do not know about the new controls

It is tempting to read the phrase "very explicit user action" as a hint about how the controls will work, but Apple has not said. The controls could be technical, such as a harder-to-reach switch, or about the wording of the prompt, or both. Anyone who tells you exactly how they will work is guessing.

What does follow from Apple's wording is the goal: that a person granting this permission clearly understands what they are granting. That goal depends on the person reading the prompt. A safety mechanism is only as good as the moment someone actually uses it, which is the same tension behind the debate over whether AI has a kill switch.

A permission ladder: what each level lets an app reach

Apple's Privacy & Security pane lists permissions at different levels. Two of them matter most for agents.

Permission	What Apple says it allows
Files & Folders	Apps can access files and folders in different locations on the Mac. The listed apps have requested access.
Full Disk Access	Apps can access all files on the computer, including data from other apps such as Mail, Messages, Safari and Home, data from Time Machine backups, and certain administrative settings for all users on the Mac.

The practical reading is a ladder. An agent that only needs to summarize documents in one folder should not need the top rung. When an app asks for Full Disk Access, it is worth asking which narrower permission would do the job, and whether you trust the developer with everything on the second row.

Check your Mac in five minutes

Apple's Support page describes where to look. Open the Apple menu, choose System Settings, click Privacy & Security, and select Full Disk Access. You will see the list of apps that have requested the permission, and Apple's page notes that you add an app with the add button.

• Read the list slowly. Most people who do this for the first time find at least one entry they do not remember approving.
• Match each app to a reason. Backup tools and disk utilities have a clear reason. An AI assistant should have one too.
• Switch off anything you no longer use. Revoking access you do not need costs nothing and can be undone later.
• Repeat for Files & Folders, where narrower access is listed. Tools that work on your folders by design, such as Google's offline note taker in our AI Edge Foresight guide, are the kind of app to look for there.

It takes a few minutes, and it protects you whether or not Apple's new controls ever reach your machine.

Questions to ask before you click Allow

Apple's own wording suggests a few questions that are worth asking whenever any app, agent or not, requests this much access:

• What does this app need that a narrower permission cannot give it? If the answer is vague, say no for now.
• Who made it, and what do they say about where your data goes? A clear privacy page is a good sign. Silence is not.
• Does it touch other people's words? Apple singled out communication apps because reading your Messages also exposes the people you talk to.
• Can you undo it? Find where the switch lives before you turn it on.
• Would you grant the same access to a stranger with a laptop? An autonomous agent can do far more with the same permission than a person scrolling your files.

A pattern bigger than one setting

Apple tightening a years-old permission because of what agents might do with it fits a theme running through the year: the gap between what software can technically be granted and what it should be allowed to do by default keeps narrowing as agents get more capable. A similar pattern shows up elsewhere. After Cloudflare's acquisition of the Deno team, many developers asked is Deno dead, because infrastructure you rely on can need rethinking without you doing anything different. And the same fortnight that brought Apple's post saw a record-breaking Windows Patch Tuesday, a reminder that shipping patches is not the same as getting permissions right.

The shift also reaches smaller tools. Agent-style features that act for you, such as Yelp's feature that places restaurant calls on a user's behalf, which we covered in Yelp's Check for Me, make the permissions behind them matter more than they used to.

What this means for developers

Apple's post was written for developers, and two of its sentences are worth reading as a design brief. It says Full Disk Access exists to let backup apps function, so an app that is not a backup tool is on notice. And it says communication apps holding the permission can compromise the privacy of the people users communicate with, not only the user. An agent that reads a user's Messages touches other people's words too.

The safer design is to ask for the narrowest permission that works, explain it in plain language at the moment of asking, and make it easy to revoke. If Apple's new controls make Full Disk Access harder to obtain, apps that already work with narrower access will feel it least.

Where the model debate fits

It is worth keeping this in perspective against the argument over which model is smartest, as in our comparison of Gemini 4 Argon, GPT-6 and Muse Spark Open. Benchmarks measure how well a model answers. They do not measure what an agent built on that model can reach once it sits on your Mac. Those are two separate questions, and only one of them just got Apple's attention. The same point applies to the many real world applications of AI that depend on access to your files: the convenience arrives together with a permission model that was designed before agents existed.

What we do not know yet

• When the controls arrive. Apple gave no date.
• Which macOS version. Apple did not name one.
• How the controls work. Apple has not described the mechanism.
• Whether the Muse dispute will be settled. The two accounts conflict, and Apple did not mention Meta.
• Which apps are affected. Press coverage guesses at specific apps, but Apple's own post names none.

The bottom line

Apple's Full Disk Access change is not a ban on AI agents. It is an announcement that an old, broadly trusted permission will need a clearer moment of consent, because the apps asking for it can now act on their own. The details are still missing, so the safest move is the one that does not depend on Apple: open System Settings, read the Full Disk Access list, and remove what you cannot explain.

FAQs

Why does my Mac keep asking for Full Disk Access?

Apps that need to reach files across the whole Mac, such as backup tools and disk utilities, ask for it. Apple Support describes the permission as access to all files on the computer, including data from Mail, Messages, Safari and Home. AI assistants are increasingly among the apps asking, which is the trend Apple cited.

What did Apple announce about Full Disk Access?

On October 2, 2026, Apple said it will introduce additional controls so users can grant Full Disk Access only through "very explicit user action", and that the risks will "grow substantially" as AI agents become more autonomous. It gave no date, version or details.

Did Meta's Muse read someone's private messages?

That is disputed. Inc. columnist Jason Aten said Meta's Muse read his messages while Full Disk Access was off. Meta says reading messages requires the user to enable both Full Disk Access and the Messages connector, and that its permission steps cannot be bypassed. Apple's post did not mention Meta.

Was the ChatGPT Mac app flaw used in attacks?

Coverage of Wired's report says Wired reported no attacks in the wild. The flaw, CVE-2026-100754, was described as limited to local ChatGPT data and resources the app could already reach, and OpenAI has patched it.

How do I check which apps have Full Disk Access?

Open the Apple menu, choose System Settings, click Privacy & Security, and select Full Disk Access. Review the list and switch off anything you do not recognize or no longer use.

When will Apple's new Full Disk Access controls launch?

Apple has not said. The post names no macOS version or date and does not describe how the controls will work.

Sources

Pages opened for this article, checked November 6, 2026:

• Apple Developer News, "Updates to Full Disk Access in macOS", October 2, 2026.
• Apple Support, "Change Privacy & Security settings on Mac" (Full Disk Access and Files & Folders).
• MacRumors, "Apple Announces 'Full Disk Access' Changes on macOS Due to AI Agents", October 2, 2026.
• TechCrunch, "Meta disputes claim that Muse read a user's private messages without permission", September 30, 2026.
• Coverage of Wired's October 2, 2026 report on CVE-2026-100754 in the ChatGPT app for Mac (secondary coverage; Wired's own article could not be opened).