Apple is preparing to introduce additional controls around Full Disk Access (FDA) in macOS, responding to growing privacy and security concerns surrounding increasingly capable AI agents.
The company says some developers are using Full Disk Access in ways that can expose sensitive information—including files, email, messages and browsing history—without users fully understanding the scope of access they have granted.
Apple's announcement specifically connects the planned changes to the growing autonomy of AI agents, warning that the risks associated with broad system-level access will increase as these tools become more capable.
What is Full Disk Access?
Full Disk Access is one of macOS's broadest privacy permissions.
Apple's current documentation states that applications with FDA can access all files on a Mac, including data belonging to other applications such as Mail, Messages and Safari, Time Machine backup data and certain administrative settings.
The permission exists for legitimate use cases.
Backup and security applications, for example, may need broad access to a system in order to inspect and protect data across multiple locations.
The problem is that the same capability can also provide an application with visibility far beyond the files a user originally intended to share.
For traditional utilities, that broad access may have been easier to justify.
AI agents change the equation.
Why AI agents make FDA more significant
Modern AI agents are designed to do more than answer questions.
Depending on their capabilities, they can read information, reason over it, interact with applications, retrieve additional data and take actions on a user's behalf.
That means a permission granted to an AI-enabled application can potentially become an access path to a much larger portion of a user's digital environment.
A user may think they are allowing an assistant to organize documents, summarize information or automate a workflow.
The underlying permission, however, may allow the application to access significantly more data—including private correspondence, browser information and files belonging to other applications.
Apple explicitly warned that as AI agents become more capable and autonomous, the risks associated with this level of access will grow substantially.
Apple wants more explicit consent
Apple's planned change is centered on how Full Disk Access is granted.
The company said it will introduce additional controls so users who genuinely want to grant an application this level of access will have to take very explicit user action.
The announcement does not describe the final interface, technical enforcement mechanism or supported macOS versions.
Apple also has not provided a specific release date for the new controls.
This distinction is important.
Apple is not announcing that Full Disk Access will disappear.
Instead, the company is signaling that the existing permission model needs additional safeguards because users may not fully understand how much information an application can access once FDA is enabled.
The privacy impact extends beyond the Mac owner
One particularly important aspect of Apple's announcement is that the privacy implications do not necessarily stop with the person who grants the permission.
Apple specifically noted that when communication applications receive Full Disk Access, the resulting access can affect the privacy of people communicating with the user.
For example, a user's Messages database does not contain only information about the user.
It can contain conversations, names, contact details, attachments and other information belonging to colleagues, customers, friends and family.
An AI application with access to that database could therefore process information belonging to individuals who never agreed to interact with the application.
This creates a broader privacy problem than conventional application permissions.
The difference between access and intent
The central issue is not necessarily that an application has access to data.
It is the gap between what the permission technically allows and what the user believes they are authorizing.
A user may enable FDA because an application says it needs access to perform a particular feature.
The operating system permission, however, can grant substantially broader access than that individual feature requires.
This creates a security principle that becomes particularly important with AI agents:
Permission should reflect the task, not simply the maximum capability of the application.
For conventional software, excessive permissions are already a security concern.
For autonomous software capable of interpreting information and taking actions, excessive permissions can become considerably more consequential.
AI agents introduce a new permission challenge
Traditional applications generally perform predefined operations.
An AI agent can dynamically determine what information it needs to complete a task.
That creates a different security model.
Consider an agent asked to prepare a briefing based on information stored on a Mac.
If it has broad access, the agent may be technically capable of searching files, messages, emails and browser-related data to find relevant context.
The user may not have intended all of those sources to be included.
The more autonomous the agent becomes, the more difficult it is for a simple system-level permission such as Allow / Don't Allow to communicate the actual scope of activity.
Apple's announcement effectively acknowledges this problem.
The operating system needs to make the consequences of granting exceptional access more visible before the user approves it.
The Meta Muse controversy
Apple's announcement arrived amid wider scrutiny of desktop AI agents, including reporting surrounding Meta's Muse.
A technology journalist reported that Muse referenced content from private Messages on a Mac, raising questions about how an AI application could access information that users expected to remain private.
Meta disputed the characterization and said Muse requires both Full Disk Access and a separate Messages connector setting for Messages content to be accessed.
That distinction is important: Full Disk Access is a macOS-level permission, while an application's own connector or feature setting determines whether the application uses a particular category of accessible data.
Apple's announcement did not name Muse or any other specific developer.
Nevertheless, the controversy illustrates the broader problem Apple is addressing: users can find it difficult to understand the difference between granting an application permission to access protected data and enabling a particular AI feature that actually processes that data.
Full Disk Access is not the only security boundary
It is also important not to treat FDA as the entire macOS security model.
macOS uses multiple privacy and security controls governing access to files, automation, accessibility and other system resources.
Apple's existing security documentation describes additional controls designed to ensure applications obtain user consent before accessing protected locations and performing certain privileged operations.
Full Disk Access is therefore best understood as an exceptionally broad permission, rather than a universal bypass of every macOS security mechanism.
For AI agents, however, its breadth makes it particularly important.
The agent may combine information obtained through different permissions and sources while carrying out a task.
What companies should do now
Apple's new controls are not yet a replacement for internal security policies.
Companies using Macs and AI-enabled applications should already review how broad permissions are being granted.
✅ Audit Full Disk Access
Review the applications currently listed under:
System Settings → Privacy & Security → Full Disk Access
Remove access from applications that no longer require it.
Apple's documentation confirms that this setting controls which applications can access protected information across the Mac.
✅ Question why an AI application needs FDA
Before granting Full Disk Access to an AI assistant, determine:
- What information does it actually need?
- Which features require FDA?
- Does it process Messages or Mail?
- Does it access browser data?
- Is information sent to an external AI service?
- Can the same task be performed with narrower permissions?
Broad access should have a clear business justification.
✅ Separate permission from trust
A reputable application can still represent a significant privacy risk if it receives more access than necessary.
Security teams should evaluate both who developed the application and what the application is technically capable of accessing.
✅ Establish policies for agentic AI
Companies should define which AI agents employees may install and what system permissions those agents can receive.
This is particularly important for applications capable of acting autonomously across files, browsers, email, messaging platforms and other business systems.
✅ Monitor sensitive data access
Endpoint and application telemetry should be used to identify unusual access to sensitive locations and unexpected behavior from AI-enabled applications.
Where possible, security teams should establish a baseline for normal application activity and investigate significant deviations.
What developers should consider
The announcement also sends a message to macOS developers.
Applications should request only the permissions necessary for their actual functionality.
For AI products, developers should make the scope of data access especially clear.
A permission prompt that simply says an application needs broad system access may technically satisfy a consent requirement while still leaving users unclear about what will happen afterward.
A better model is to explain:
What data is accessed → why it is accessed → how it is processed → where it goes → what actions the agent can take.
This becomes increasingly important as AI systems move from passive assistants toward autonomous agents.
The bigger cybersecurity lesson
Apple's decision highlights a broader problem emerging across the AI industry:
Traditional application permissions were not designed around autonomous software.
A conventional application might request access to files because it needs to edit or back them up.
An AI agent may request access because it needs context.
That distinction matters.
Context can include highly sensitive information that the user never explicitly intended to provide to the agent.
Once that information becomes available, the agent may be able to combine it with other data, derive additional information and use it to perform actions.
The security challenge therefore extends beyond “Can the application read this file?”
It becomes:
“What can the agent infer, access and do once it can read this file?”
That is a much more complex security question.
Final thoughts
Apple's planned changes to Full Disk Access represent an important adjustment to the macOS security model as AI agents become more autonomous.
The company is not eliminating broad system access. Instead, it intends to make granting that access a more deliberate decision, particularly because users may not fully understand how much information an application can reach once FDA is enabled.
AI agents should be treated as privileged software when they can access corporate files, email, messaging platforms, browsers or other sensitive systems.
The combination of broad permissions + autonomous decision-making + sensitive data creates a new class of security risk that traditional application-permission models were not designed to address.
