Tech · NEWS EXPLAINER
Apple will tighten Mac Full Disk Access for AI agents—what users should check now
Apple says future macOS controls will require very explicit action before an app receives Full Disk Access, but it gave no rollout date or macOS version. Users can already audit current grants and each AI agent connector; the reported Meta Muse incident remains disputed.
Apple has promised stronger macOS controls for Full Disk Access, but it has not announced when they will ship or which macOS version will contain them. Mac users can act now by checking which apps have the permission, revoking grants they no longer need, and separately reviewing every connector used by an AI agent.
What Apple announced—and what it did not
Apple says it will add controls to macOS so granting an app Full Disk Access requires “very explicit user action.” The company describes that permission as extraordinary because it largely bypasses the privacy controls that normally separate apps from sensitive data. Apple says the issue is becoming more urgent as AI agents gain autonomy and can act across more services.
The announcement is a commitment, not a shipping notice. Apple did not identify a macOS version, a release date, a new dialog design or a list of apps that will be affected. Users should therefore not assume that a software update available today already contains the promised controls; the current task is to review permissions that are already granted.
Why Full Disk Access deserves a separate check
Full Disk Access exists so utilities such as backup software can read files across a Mac. Apple says that breadth can expose files, mail, messages and browsing history when a developer uses it in a way the user does not fully understand. For communication apps, the exposure can also involve information belonging to other people in a conversation.
That does not mean every app with the permission is malicious, or that every AI agent has it. The practical risk depends on which app received access, what other connectors or accounts it can use, and whether the access is still necessary. A permission that was reasonable for a backup tool may be excessive for an app whose current job does not require the whole disk.
How to review the permission now
On a current Mac, open System Settings, choose Privacy & Security, and review Full Disk Access. Read the list rather than toggling everything at once: identify the developer, the task you installed the app to perform, and whether that task truly needs broad disk access. If you no longer use an app or cannot explain why it needs the permission, turn its access off or remove the app after preserving any data you need.
Revoking access can interrupt backups, security scans or other legitimate functions. After changing a setting, quit and reopen the affected app if macOS asks, then confirm that the feature you still need works. If it fails, consult the developer’s current documentation before restoring access; a narrower folder, account or connector permission may be sufficient.
Check the agent’s own connectors too
Full Disk Access is only one layer. An AI agent may also have separate connectors for messages, email, calendars, cloud storage, shopping or financial services. Review those permissions inside the agent and in each connected service, and disconnect anything that is no longer required. Removing a connector can reduce exposure even when the Mac app remains installed.
Also install current macOS and app updates from verified sources, and treat new permission prompts as decisions rather than setup obstacles. A prompt asking for broad access should explain the feature that needs it. If the explanation is vague, pause and check the developer’s support page instead of granting access merely to finish onboarding.
What remains disputed about Meta’s Muse
The timing follows a report from technology columnist Jason Aten, who said Meta’s Muse referenced private Apple Messages content even though he believed he had not granted the necessary access. Meta disputes that account. Its representatives say Messages access is opt-in and requires both macOS Full Disk Access and a Messages connector in Muse.
The public reporting does not establish the exact permission state on that Mac at the moment of the incident. Apple did not name Meta, Muse or any other developer in its announcement. The safe conclusion is therefore limited: Apple sees broad Full Disk Access as a growing risk and plans stronger consent controls, while the specific Muse permission dispute remains unresolved.
A practical decision rule until Apple ships the change
Keep Full Disk Access only when three things are clear: you trust the developer, the feature genuinely needs whole-disk visibility, and you still use that feature. Recheck the list after uninstalling utilities, changing backup products or testing a new agent. For agents, review both the macOS permission and every service connector because either layer can expand what the agent can reach.
When Apple publishes a macOS version or rollout date, read the release notes to learn whether the new control changes existing grants or only future requests. Until then, no special download or emergency migration is required by this announcement. The useful action today is a careful permission audit, not a claim that every AI tool has already accessed private data.
