Apple wants to make sure you know exactly what you’re signing up for before giving an AI agent access to your Mac.
The company said in a developer blog post on Friday that it plans to introduce additional privacy controls for macOS’s “Full Disk Access” setting, which gives apps permission to read sensitive information, including emails, private messages, browsing history, and other personal files.
“Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems — including files, mail, messages, and even browsing history — without users’ full knowledge and understanding,” Apple said.
“Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action,” Apple added. “As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.”
For Mac users, that means granting apps a sweeping level of access will require ‘very explicit user action,’ without explaining how that will differ from the current process. Apple hasn’t detailed exactly how the new safeguards will work or when they’ll arrive. The company did not say the changes would apply only to AI agents; it said the risks of permission will grow as agents become more capable and autonomous.
According to the blog post, the setting was originally intended to help backup software operate, but increasingly capable AI agents are creating new risks.
Last month, Inc. columnist Jason Aten alleged that Meta’s Muse AI agent had accessed private messages on his Mac mini without his permission. Meta disputed the claim.
Andy Stone, Meta’s vice president of communication, wrote in a post on X that “the Messages integration in the Muse app for Mac is entirely opt-in.”
“You have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content,” Stone said. “It can’t read your Messages unless you do this. And it can be revoked at any time.”
