macOS Full Disk Access Gets Stricter for AI Agents
Apple says it will add explicit-action controls to macOS Full Disk Access because of AI agents. What was announced, what was not, and what to do now.
Apple said on 2 October 2026 that it will add new controls around macOS Full Disk Access, so that granting an app that level of access takes "very explicit user action". The stated reason is AI agents. Apple gave no release date, no macOS version, and no description of how the new flow will look.
What Apple actually said
The announcement is a short item on the Apple developer news page. Apple says Full Disk Access "largely sidesteps" the controls that normally protect private data, because backup apps need it to work. It then says some developers are using it in ways that expose "everything on their systems", including files, mail, messages and browsing history, without users fully understanding that.
The sentence that matters for anyone building or running agents: "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."
Apple also notes that for communication apps the exposure reaches the people a user talks to, not only the user.
What triggered it
TechCrunch ties the timing to two recent stories. A journalist claimed Meta's Muse app on Mac read their private messages, a claim Meta disputes. Separately, a report cited a flaw in the ChatGPT Mac app that could have let attackers reach sensitive data. We covered the separate Muse disclosure in our write-up of the Meta Muse macOS zero-day.
What is not known yet
When the change ships, and in which macOS release.
Whether apps that already hold Full Disk Access will be asked again or grandfathered in.
Whether the new flow applies only to Full Disk Access or also to neighbouring permissions such as accessibility and screen recording.
Treat anything more specific than Apple's own two paragraphs as speculation until Apple publishes developer documentation.
What to do before the change lands
Full Disk Access is the broadest permission on the Mac, and agent desktop apps often ask for it so they can read whatever you point them at. A narrower grant usually does the job.
Open System Settings, then Privacy and Security, and review the Full Disk Access list. Remove anything you do not recognise or no longer use.
For each agent app, ask whether it needs the whole disk or just a project folder. Our guide to restricting an AI coding agent's file system access covers the folder-scoped alternatives.
Keep mail and messages out of reach unless the agent's job is mail or messages. The same blast-radius logic applies to giving an agent access to your inbox.
If you ship a Mac app that asks users for Full Disk Access, plan for a permission prompt that explains exactly why you need it. A vague request is likely to age badly.
For the step-by-step version, see how to check Mac app permissions before using an AI agent. The wider picture of agent risk lives in the AI risks guide.
Why this matters beyond Mac users
Operating system vendors are now writing agent risk into permission models. That is a useful signal about where default behaviour is heading: broad, one-time, forgotten grants are the pattern being targeted, and per-task, explicit, revocable access is the pattern replacing it. Tools built that way today will need the least rework later.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
