Apple Tightens macOS 'Full Disk Access' After AI Agents Turned a Backup Permission Into a Master Key

After reports that AI agents could read private messages and files, Apple says it will add new controls so full-disk access on the Mac requires "very explicit user action." No timeline yet.

Apple is moving to rein in one of the Mac's most sweeping permissions, saying AI agents have turned a setting meant for backup software into a privacy hazard.

In a note on its developer news site, the company said it will add "additional controls" to the macOS "Full Disk Access" setting — the switch that lets an app read or write almost anything on a Mac's drive, including files, mail, messages, contacts, photos and browsing history. The permission exists so backup and restore tools can work, but Apple says developers have stretched it well beyond that.

"Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems — including files, mail, messages, and even browsing history — without users' full knowledge and understanding," Apple wrote. "For communication apps, this can also compromise the privacy of the people users are communicating with."

Going forward, Apple says users who "genuinely wish to grant an app this extraordinary level of access" will be able to do so only "with very explicit user action." The company did not say when the new controls will arrive or what form they will take — likely sterner consent language or an extra confirmation step rather than a hard technical block.

The announcement lands days after Inc. columnist Jason Aten reported that Meta's Muse AI agent on his Mac appeared to know the contents of his private messages even though he said he never granted it permission; Meta disputed that account. It also follows a Wired report that a flaw in ChatGPT's Mac app could have let hackers grab sensitive data.

The backdrop is the rapid spread of always-on desktop agents that run on the same machine as your files. A permission built for automated backups now doubles as a master key — and Apple is signaling that the era of granting it with a single click may be ending.

Sources: Apple Developer | TechCrunch | MacRumors | Macworld