Apple tightens full-disk access to block AI agent snooping
Original: Apple changes full-disk access permissions to curb abuse from AI agents
Why This Matters
Sets a precedent for how OS vendors will constrain AI agents' system-level data access.
Apple announced macOS changes to full-disk access (FDA) permissions on Oct 2, 2026, after Meta's AI agent Muse was accused of reading Apple Messages without users' explicit awareness, reigniting debate over AI agent data access.
The move follows a public dispute triggered when tech columnist Jason Aten reported that Meta's general-purpose AI agent Muse sent him an unsolicited notification referencing a private Apple Messages thread—one he never knowingly authorized Muse to access. The incident went viral, with users comparing unchecked AI agents to power tools: useful, but capable of serious harm without proper controls.
Meta CTO David Singleton defended Muse, saying access to Apple Messages requires two deliberate user actions: granting macOS Full Disk Access and separately enabling Muse's Messages connector. His implication was that if Muse read Aten's messages, Aten had enabled both himself.
But macOS security researcher Patrick Wardle pushed back, noting that FDA by design grants read access to virtually any non-root file on the system—messages, browser history, cookies, and more—regardless of what a developer claims their app does with that data. Meta's PR team declined to address that technical argument directly, simply re-quoting Singleton.
Apple's statement didn't name Meta or Muse, but the context was unmistakable. The company wrote that some developers are using FDA 'in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users' full knowledge.' Apple added that as AI agents grow 'increasingly capable and autonomous, the risks associated with this level of access will grow substantially.' Specific changes to FDA permissions were not detailed in Friday's announcement.