In direct response to the privacy risks posed by a new generation of autonomous AI agents running on Mac computers, Apple is making substantial changes to one of macOS’s most powerful and least examined permissions.
In a statement released on Friday, October 2, 2026, Apple announced plans to introduce new controls for a setting known as Full Disk Access (FDA), the permission that gives an app complete visibility into a Mac’s system files, mail, messages, and browsing history. Going forward, the company said granting this kind of access will require “very explicit user action.”
Why Full Disk Access Is the Problem
Full Disk Access was created with a specific aim: enabling backup programs such as SuperDuper and Carbon Copy Cloner to read an entire disk to make complete system backups. However, this same extensive level of access makes it a particularly dangerous permission in the AI age since FDA bypasses the usual privacy safeguards of macOS, which are the per-app settings that normally allow individual access to things like the camera, microphone, and photo library.
After an application has been given Full Disk Access, it can access almost everything on the machine, since that information would normally be kept behind more specific permissions.
Apple stated that “as AI agents become more capable and autonomous, the risks linked to this degree of access will increase substantially”. “We are committed to making sure that users fully understand these risks before giving such access so that they can make informed decisions regarding their own data and privacy.”
The Meta Muse Controversy
Apple’s announcement did not mention any specific companies, but its timing coincides with a public disagreement involving Meta’s AI agent, Muse, which the company launched last month as a “personal AI agent built for everyone”.
A technology columnist publicly claimed that Muse had looked at his private Messages data without his permission. Meta denied the claim and said three separate, explicit user actions are required before this type of access can occur: enabling Full Disk Access, enabling Muse’s in-app Messages connector, and responding to a macOS system permission dialog.
No matter where the fault lay in that case, the incident seems to have sped up Apple’s plans to reconsider how the FDA operates in a world where software doesn’t merely passively store data but can act on it autonomously.
Not Just a Meta Problem
It isn’t just Meta’s Muse that is asking for this kind of access. The ChatGPT Mac app from OpenAI, Claude for Mac, and other agent tools also request Full Disk Access in order to provide features such as message summarisation or carrying out tasks across applications.
In August, OpenAI made available an optional feature for its ChatGPT Mac app which allows the assistant to read, summarise, write and send text messages on the user’s behalf, a functionality just like this one also requiring Full Disk Access in order to retrieve data from Apple’s Messages app.
In addition, security researcher Patrick Wardle identified a particular vulnerability, listed as CVE-2026-100754, in the OpenAI ChatGPT Mac application which might have enabled an attacker to take control of the AI assistant and obtain unauthorized access to the chat logs and other stored data, highlighting the fact that permission design is not the only AI-agent security issue that Apple is dealing with.
A First-of-Its-Kind Move
As industry observers have pointed out, this was the first instance in which a leading operating system vendor updated its core system permissions specifically in response to risks associated with AI agents, rather than conventional app security concerns.
The implications go beyond privacy. Financial analysts, such as those employed by Bank of America, have stated that Apple could lose its control over what they refer to as “the post-device moment,” that is, the software layer which actually oversees a user’s daily digital life, to the company that develops the most capable AI agent operating on top of its operating system. Restricting Full Disk Access is a defensive move aimed as much at protecting Apple’s position on the platform as at serving as a consumer protection measure.
What Comes Next
Apple has not made clear exactly what the new controls will look like or which version of macOS will feature them. The fact that macOS 27, released on September 14, 2026, doesn’t include these changes indicates that the feature is still under active development.
For now, Mac users with AI agents that request Full Disk Access should take that permission request seriously and expect Apple to make it much harder to accidentally grant it in a future macOS update.
