Apple announced a tightening of Full Disk Access controls on macOS, a move directly prompted by the rapid rise of AI agents on the platform. The decision follows multiple incidents involving Meta Muse and ChatGPT, and aims to restore user trust in how personal data is shared with third-party apps.
🔑 Key takeaways
- Apple will introduce new restrictions on macOS Full Disk Access to limit abuse by AI agents.
- A reporter found that Meta’s Muse agent could read his private messages without explicit permission.
- A flaw in the ChatGPT Mac app could have allowed attackers to execute malicious commands.
- OpenAI says over 35 million people now use its agent tools, up from 10 million in July.
- Apple has not yet shared a deployment timeline or technical details of the new controls.
Full Disk Access: a controversial backdoor in macOS
The Full Disk Access setting allows an application to read the entire macOS system: files, emails, messages, browsing history, and data from other apps. In practice, it bypasses the granular privacy controls — known as TCC (Transparency, Consent, and Control) — that Apple normally uses to gate sensitive resources.
Apple acknowledges that this permission exists mainly for technical reasons: backup software such as Time Machine, Backblaze, and Carbon Copy Cloner requires exhaustive system access to do its job. But the company now admits that some developers, especially AI agent vendors, are exploiting it in ways users do not understand.
“Some developers use Full Disk Access in ways that could put users at risk, exposing everything on their systems without their full knowledge and understanding.”
Apple, developer notice
Apple also highlights a frequently overlooked point: when a communications app receives this level of access, it is not just the user’s privacy that is compromised, but also that of every person they exchange messages with. A messaging client, email app, or video conferencing tool with Full Disk Access can theoretically read conversations sent by third parties who never consented to be monitored.
Two incidents that pushed Apple to act
The Meta Muse controversy
Journalist Jason Aten, writing for Inc. magazine, published a detailed account of his discovery: Meta’s Muse agent appeared to know the contents of his private messages on his Mac mini, even though he had never explicitly granted it that permission. The app, which has been downloaded more than 5 million times, allegedly accessed conversations through macOS’s Messages connector.
Andy Stone, Meta’s head of communications, disputed the claim on X, stating that Muse can only read messages when users enable both Full Disk Access and the Messages connector — and that the access can be revoked at any time. The dispute nonetheless exposes a deeper transparency issue: users often have no idea that combining two permissions unlocks such a wide data pipeline.
The ChatGPT flaw patched by OpenAI
A Wired report also exposed a vulnerability in the ChatGPT Mac app: a flaw that could have allowed attackers to hijack the agent and execute malicious commands on the user’s machine. OpenAI has since patched the bug, but the incident highlights the structural risks of AI agents that run with high autonomy on a host system.
OpenAI had already added, back in August, an optional feature that lets ChatGPT read, summarize, and send text — a capability that also requires Full Disk Access. The company recently said more than 35 million people now use its agent tools (ChatGPT Work and Codex), up from just 10 million in July 2025. Mass adoption amplifies the security stakes considerably.
| Application | Type of incident | Status |
|---|---|---|
| Meta Muse | Access to private messages via Full Disk Access + Messages connector | Allegation disputed by Meta |
| ChatGPT (Mac app) | Flaw allowing execution of malicious commands | Patched by OpenAI |
What new restrictions will Apple introduce?
In its developer communication, Apple said Full Disk Access will not be removed — it remains essential for backup software and certain professional use cases. Instead, new controls will be deployed to ensure that granting this permission requires a “very explicit user action.” The goal is to break the implicit chain of Full Disk Access plus secondary permission that currently lets an AI agent read sensitive data without the user fully understanding what is happening.
Apple has not yet announced a specific date or technical implementation. The company is likely to roll out a stronger warning system, possibly a two-step consent flow similar to what it already uses for accessibility permissions.
“As AI agents become more capable and autonomous, the risks associated with that level of access will grow substantially.”
Apple, official statement
Conclusion: a strong signal for the wider AI ecosystem
Apple’s decision is part of a broader move by platforms to reassert control as AI agents proliferate. By tightening the conditions for Full Disk Access, the company is sending a clear message to developers: agent autonomy cannot be built on top of a silent bypass of macOS’s native protections. For users, it represents a meaningful step forward in transparency and data control.
A central question remains: will these new restrictions be enough to rein in the creativity of AI vendors, or will they find new ways to access user data? The answer will depend as much on Apple’s technical rigor as on regulatory pressure — including the European Union’s Digital Markets Act and the upcoming obligations of the AI Act — which could accelerate the adoption of common standards for autonomous agents.
Sources
This article is published for informational and educational purposes only. It does not constitute investment advice. Do your own research (DYOR) before making any decision.
