macOS Full Disk Access: what Apple is changing and why

Apple is adding new controls to macOS Full Disk Access so that an app can only get it through "very explicit user action," and it says AI agents are the reason. Apple gave no date or macOS version, so nothing changes on your Mac today, but you can check which apps already hold that permission in about a minute.

The announcement went up on Apple's developer news page on October 2. It came two days after Meta publicly disputed a writer's account of what its Muse agent read on his Mac.

The post that set it up

On September 30, Meta's communications chief @andymstone posted that "the Messages integration in the Muse app for Mac is entirely opt-in." He wrote that Muse can only read your texts if you turn on two things: macOS Full Disk Access and the Messages connector inside Muse.

He was answering Jason Aten, an Inc. columnist. Aten installed Muse on an iPhone and a Mac mini and turned down Messages access during setup. Days later, according to The Next Web, Muse pitched him a column idea built on a conversation he'd just had with his podcast co-host. It also flagged a message from his editor. When he asked how it knew, Muse said it only saw incoming notifications. Aten then found it had synced his Messages database up to row 187,462, and he says Muse's own settings showed Full Disk Access as off.

Meta's David Singleton replied on Threads that the explanation Muse gave Aten was wrong, and that reading Messages takes three separate permission steps a bug can't skip. The two sides still disagree about what happened on that Mac, though even Meta concedes the agent gave a false account of its own access.

What Apple actually said

Apple's note is short. Full Disk Access exists mostly so backup apps can work, and it "largely sidesteps" the privacy controls that protect everything else. Apple says some developers use it in ways that expose "files, mail, messages, and even browsing history" without users fully understanding the trade. For a messaging app, that also exposes the people on the other end of the conversation.

The key line for anyone running agents: "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially." TechCrunch adds that a Wired report on a flaw in ChatGPT's Mac app was the other incident in the background.

My read

The permission was built for an app that copies your files and does nothing else with them. An agent reads what it finds and acts on it, and it can carry what it saw into an email or a message to someone else. The switch is the same one, but the risk behind it is much bigger.

Apple's fix is a bigger warning before you hand that access over. That's useful, but it puts the decision back on the person clicking. Muse is a good example of where that goes wrong. If an agent can't accurately tell you what it can see, a well-worded dialog box only goes so far.

Some pushback is fair. At MacStories, John Voorhees points out that launchers, utilities and other ordinary apps on his MacBook use Full Disk Access too, not just backup tools. Whatever Apple ships could create friction for apps people depend on.

How to check your Macs now

Open System Settings, go to Privacy & Security, and click Full Disk Access. Every app with the switch turned on can read nearly everything on that machine, including Mail and Messages. Turn off anything you don't recognize or no longer need. Your backup software probably belongs there. A chat assistant or an agent that "organizes your files" usually doesn't need it, and you can keep giving those tools single folders.

Do this on every Mac that touches customer data, including the one at the front desk. If you're working out which agent should get which access, we wrote about how Muse connects to your Mac and your business tools when it launched there.

What it means for your business

Agents now sit on the same computers that hold your customer records, and Apple is admitting its permission system wasn't built for them. Before you install one, decide what it's allowed to touch and give it the smallest access that does the job. Then check its work for a while, because Muse showed an agent's description of itself can be wrong.

If you'd like a second set of eyes on where AI fits in your operation and where it needs a fence, New Face Design offers a free process audit for Fox Valley businesses.