Apple says it will introduce additional controls around macOS Full Disk Access, warning that increasingly autonomous AI agents make the permission riskier. In an October 2 developer announcement, the company said users should have to take especially explicit action before granting an app this unusually broad authority.

The setting was designed to let backup software do its job. Apple now says some developers are using it in ways that can expose files, mail, messages and browsing history without users fully understanding the consequences. Communications create a second privacy problem: granting access to your own computer can also expose information belonging to people who exchange messages with you.

A permission bigger than one task

Apple’s current settings guide describes Full Disk Access as covering files from other apps, Time Machine backups and certain administrative settings. Files & Folders, Accessibility and Automation appear as separate permissions. That distinction matters when an assistant asks to read one document or complete one workflow: its operating-system privileges may extend further than the immediate request.

The announcement follows a dispute over Meta’s Muse assistant. As Ars Technica reported, columnist Jason Aten said Muse referenced private Messages conversations he had not authorized it to read. Meta said Messages access requires both Full Disk Access and an enabled Messages connector. Apple did not name Muse or any developer, and its statement does not establish what happened in that individual case.

What Mac users can check now

Apple has not identified a release date, a macOS version or the detailed design of the promised controls. The announcement is a policy direction, rather than evidence that a new protection is already installed.

For now, users can review existing access under System Settings > Privacy & Security > Full Disk Access. Apple also provides separate controls for specific folders. Our takeaway: check the scope of each permission before treating an assistant’s task-level consent as a complete description of what the app can reach.