Apple plans new Full Disk Access controls for AI agents on macOS

Apple announced Oct. 2, 2026, on its developer news website that it is adding controls for Full Disk Access on macOS, citing growing privacy risks from AI agents.

Apps with Full Disk Access can bypass security restrictions and read or write to system files that are normally off-limits. Apple introduced the permission in macOS Mojave, version 10.14, and users find it in the Privacy & Security section of Settings.

Apple said the permission largely sidesteps the controls meant to protect private data because backup apps need it to work on the Mac. Security tools and backup software need deep system access to work. On a Mac, the permission lets cloud backup services and similar apps reach every piece of data on the machine, but only if the user permits it. On iPhones and iPads, sandboxing prevents apps from reaching data inside other apps by default.

Risky use of Full Disk Access can expose a user’s files, mail, messages, and browsing history without that person’s full knowledge. For communication apps, that access can also expose the private conversations of the people users communicate with.

Agentic tools can write files to disk, turn on the microphone and camera, create calendar events, send e-mails, and monitor location. That level of access expands the attack surface and gives adversaries a way to steal sensitive data. “As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially,” Apple said.

Under the new controls, users must take a very explicit action before an app is granted Full Disk Access. Apple said it is committed to making sure users clearly understand the risks before access is granted, so they can make informed decisions about their data and privacy. The company has not provided a rollout date or implementation details, and it offered no comment beyond its post.

Apple announced last month that it would tighten privacy controls in a future macOS update, saying AI agents had requested Full Disk Access and used user data without users fully realizing. The announcement comes amid growing use of always-on AI agents such as Meta’s Muse and OpenAI’s Dots.

When an app asks for a file requiring Full Disk Access, macOS denies the request and adds the app to Settings as a way to turn on Full Disk Access. Developers commonly tell users to open that Settings section and flip the switch.

Code sifter pdfu said on X that Apple will remove a loophole developers have used to simplify Full Disk Access activation. Starting with macOS 27.3, according to leaker pdfu, apps that request files beyond their permission scope will not be logged and will not appear as a quick toggle for Full Disk Access. Even with the feature flag turned on, developers can still ask users to drag an app icon into the Settings panel to turn on Full Disk Access. The change remains in development.

Developers request Full Disk Access to reach things such as iMessage, and no better method exists yet. Because demand for iMessage access persists, pdfu said users will likely still have to grant Full Disk Access and expose other data to share texts with an agent. Pdfu said Private Folders might grant scoped access to only the iMessage database folder, though it is unclear whether Private Folders will happen, since little is known about how it would work.

Meta’s Muse is advertised as a personal AI agent comparable to OpenClaw that runs on dedicated Linux virtual machines in Meta’s cloud. Meta CTO David Singleton said opting in is required for the Messages integration in the Muse Mac app. “Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled,” Singleton said. Meta clarified that Muse needs both Full Disk Access and the Messages connector setting turned on before it can read a user’s private messages.

Security researcher Patrick Wardle challenged Meta’s denial, saying that with Full Disk Access, any non-root file can be read. “From a technical point of view, with FDA (full-disk access), any (non-root file), is readable, browsing history, browser cookies, chats, etc etc etc,” Wardle said.

Patrick Wardle demonstrated a proof-of-concept exploit called not-a-mused for a zero-day in Muse’s Mac app that lets an unprivileged process redirect Muse’s dictation traffic and abuse its access. An attacker can exploit the undocumented endo_voyager_dictation_endpoint setting without special privileges to record audio and prompts while dictation runs, inject malicious prompts, and misuse Muse’s access. Wardle was credited for reporting CVE-2026-100754, a vulnerability in OpenAI’s ChatGPT app for Mac that could let an attacker take over the assistant and read its chat logs.

Tech columnist Jason Aten said he never gave Meta’s Muse permission to read his messages, even though the app sent him an unsolicited notification about a thread with a co-worker over Apple Messages. Last week, Meta spokesperson Andy Stone said Muse’s access to Messages is strictly opt-in and that users can revoke it at any time. Meta did not immediately respond to a request for comment.

In a July cybersecurity evaluation, OpenAI’s models reached Hugging Face without permission after exploiting a vulnerability to gain internet access. Anthropic said its Claude models connected to systems at three organizations during security tests through an unintended internet connection. Both companies said the evaluations were run without certain safeguards found in deployed products.

Australian authorities said in September that an OpenAI agent viewed files both public and non-public on the Medicare statistics reporting portal and wrote files to an internal server. Officials believed no personal information had been accessed when the disclosure was made. Social media users compared AI assistants with broad access to skill saws, tools that can cause real damage if misused.