Apple Tightens Full Disk Access on macOS, With AI Agents in Its Sights
In just a few lines, Apple announces that macOS's most powerful permission will soon require a "very explicit" user action, and names AI agents as the reason.
Who covers it
Picked up by 3 outlets · 1 top-tier · 2 tech
In brief
In a note published on October 2, 2026 on its developer portal, Apple announces new controls around Full Disk Access, the permission that lets an app read nearly everything on a Mac. The company says some developers are using it in risky ways and justifies this crackdown by pointing to the rise of autonomous AI agents. For any tool that relies on broad system access, this is a signal worth taking seriously.
🍺 Bar-stool version
Full Disk Access is the Mac's master key: meant so your backup software can copy everything, it also opens up your mail, messages, and browsing history. Apple has noticed that some apps request it the way you'd ask for a spare key just to water a plant. With AI agents acting on their own, handing over this keyring to software is like leaving a very motivated intern alone in the archive room, with a lighter. Soon, you'll really have to mean it to hand it over, and the whole way we plug an AI into our computers will have to adapt.
Key takeaways
- 1
In a developer note dated October 2, 2026, Apple announces "additional controls" around Full Disk Access on macOS.
- 2
Full Disk Access largely bypasses macOS's privacy protections; Apple notes it mainly exists so backup apps can function properly.
- 3
According to Apple, some developers use it in ways that expose files, mail, messages, and browsing history without users fully grasping the scope.
- 4
For communication apps, Apple points out that the risk also extends to the privacy of the people the user talks to.
- 5
Going forward, granting this access will require a "very explicit" user action; the exact form of these controls isn't specified.
- 6
Apple explicitly justifies this tightening by citing AI agents, whose risks tied to this level of access will "grow substantially" as they become more autonomous.
What Apple Says
The note is brief: just a few sentences posted on Apple Developer's news feed, with no timeline or technical detail. But the message is clear: Full Disk Access is about to become harder to grant.
Apple promises additional controls so that only users who "genuinely" wish to can grant this level of access, and only through a "very explicit" action. The company itself describes it as an "extraordinary" level of access.
An Exception That Became a Backdoor
macOS governs access to private data through a set of granular permissions that developers must request one by one. Full Disk Access is the exception: it largely sidesteps these safeguards.
Apple restates its purpose: letting backup software work properly, since it needs to be able to read everything. The problem, according to the company, is that some developers use it beyond that scope.
The result: an app granted this access can read files, mail, messages, and even browsing history, without the user fully understanding what they agreed to.
AI Agents, the Implicit Target
The most notable passage is a single sentence: as AI agents become more capable and autonomous, the risks associated with this level of access will increase sharply.
Apple names no app or vendor. But the link is direct: an agent that reads and acts across the entire system, with full access, turns every mistake, every malicious instruction, or every leak into an exposure of the user's entire digital life.
The Case of Communication Apps
Apple adds an often-overlooked angle: when a communication app gets this access, it's not just the user's data that's exposed, but also that of the people they're talking to.
In other words, one user's consent can put the privacy of third parties who agreed to nothing at risk. This is one of the arguments Apple uses to justify a more demanding consent requirement.
“Full Disk Access largely sidesteps these controls in order to allow backup apps to function properly on the Mac.”
“As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.”
“users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action”
Why it matters
This note matters less for what it details than for what it openly admits: Apple is publicly naming autonomous AI agents as a structural security risk for the Mac, and drawing a concrete consequence for system permissions. For makers of agents, coding assistants, or automation tools that rely on broad disk access, this signals more friction at install time, and possibly the need to move toward more targeted APIs. The intent to protect users is hard to argue with, but the announcement leaves a lot of gray areas: no timeline, no description of the new controls, no criteria distinguishing legitimate use from abuse. Apple is positioning itself as the arbiter of what an AI agent is allowed to see on a Mac, at the very moment the company is building its own AI features into the system. The line between privacy protection and platform advantage will be worth watching once the details arrive.
Free account
You just read an AI Sources article
Create a free account: a month of archives in full, your own sources summed up like this one, your notes and highlights.
For you
Put it to work on your sources.
Free: a month of articles and three sources of your own. Pro: the whole archive and your sources, from €8/month.
For your team
The same machine, on your topics.
A space in your colours, your watch angles, your curators. Pilot open to three companies.
Read next
#california2 OctCybersecurity: California Issues a Subpoena to OpenAI
Attorney General Rob Bonta moves from warning letters to formal investigative action, raising the question of labs' legal liability when their models facilitate cyberattacks.
Source · oag.ca.gov · As Part of Ongoing Investigation, Attorney General Bonta Serves Investigative Subpoena on OpenAI
#evaluation1 OctSteering a LLM has a price: Apple measures what control costs in fluency
A study from Apple and Pompeu Fabra University shows that the most effective control methods are often the ones that damage generated text the most.
Source · Apple Machine Learning Research · On the Effectiveness-Fluency Trade-Off in LLM Conditioning: A Systematic Study
#china1 OctOpenAI Accuses Moonshot AI of Siphoning Its Models' Hidden Reasoning
More than 15,000 accounts, peaks of 16,000 requests in two days: OpenAI details an adversarial distillation campaign it partly attributes to Kimi's creator.
Source · Blog d'OpenAI · Disrupting a coordinated model-distillation campaign