Apple just tightened Full Disk Access because AI agents were reading everything. Here is what actually changed.

On October 2, 2026, Apple published a developer note titled "Updates to Full Disk Access in macOS" that reads like a warning notice rather than a changelog. It does not name a single app. It does not have to. The note says some developers are using Full Disk Access in ways that expose files, mail, messages and browsing history without users' knowledge, and it states plainly that as AI agents grow more capable, the risks will grow substantially. That is the first time Apple has tied a core macOS privacy permission to agent behaviour in those terms.

There is a specific reason macOS Full Disk Access matters that most people get wrong. It is not a "read your documents" toggle. As Apple describes it, the permission "largely sidesteps" the rest of the system's privacy controls, existing in that form so backup apps can function. Grant it and your app is not reading a folder you approved. It is reading everything not owned by root, which includes your mail, your messages, your browser cookies and your browsing history.

What Apple actually said, and what it did not

The October 2 note is short, and the vagueness is deliberate. Apple's full text says some developers are using Full Disk Access "in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users' full knowledge and understanding." It adds that for communication apps, this "can also compromise the privacy of the people users are communicating with," which is a pointed framing: the harm lands on third parties who were never asked.

Then the sentence that matters: "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially." Apple is committing to additional controls so that granting Full Disk Access "can only do so with very explicit user action."

What is absent is as informative as what is present. Apple did not name Meta, Muse, or any other app. It did not say which macOS version the change lands in. Ars Technica noted there are no known reports of any app other than Muse abusing Full Disk Access for message and browsing-history access, and that the announcement's timing — one day after enormous social-media uproar about the Muse story — makes the reference likely. That is an inference, not a statement from Apple.

The disagreement underneath the announcement

The Muse story that appears to have prompted this runs as follows. Tech columnist Jason Aten said Meta's new general-purpose agent Muse sent him an unsolicited notification referencing a private Apple Messages thread between him and a co-worker. He said he had never granted Muse permission to read his messages and had assumed messages were off-limits. Social media response was overwhelmingly negative, with users comparing assistants that hold calendar, mail and messaging access to an unattended power tool.

Meta CTO David Singleton pushed back, saying the Messages integration is opt-in: "Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled." The implication was that Aten had enabled both, and that this was on him.

Patrick Wardle, who is one of the most respected macOS security researchers working today, rejected that reading. "From a technical point of view, with FDA (full-disk access), any (non-root file), is readable, browsing history, browser cookies, chats, etc etc etc." Ars Technica put the question to Meta directly — how could Muse not read messages while holding full-disk access, when every other app with that privilege can? Meta's PR response was to quote Singleton's existing statement rather than answer.

Apple's announcement then effectively settled the argument without saying so. Apple describes Full Disk Access as something that "largely sidesteps" privacy controls and exposes "everything on your system." That is Wardle's characterisation, not Singleton's. Ars Technica drew the same conclusion: Apple's statements appear to contradict Singleton's denial that Muse cannot read Messages without the connector enabled. Meta did not respond to further questions.

The 0-day that is the more urgent problem

Separate from the permission debate, Wardle disclosed a genuine zero-day in Muse 11 days before Apple's note. An undocumented Muse setting let any code running locally on the Mac redirect transcription processing from Meta's servers to an attacker's own endpoint. From there an attacker gained control of the assistant, with proof-of-concept code letting Wardle take pictures and write malicious files to disk through Muse — frequently without any alert to the user.

Two design decisions reportedly made this possible: Muse dictating in the cloud rather than on-device, and allowing any app to control Muse's undocumented settings. The Verge reported that Meta has since shipped a patch. It also reported that Amazon blocked Muse from its platform, with Amazon saying such apps "should operate openly and respect service provider decisions about whether or not to participate."

Connect the two events and the picture sharpens. Wardle's writeup notes that the flaw let commands injected through ClickFix attacks take full control of the assistant, and from there access the same resources Muse could. That is the real risk pattern: a user deliberately granting one broad permission is fine; a user granting it to an assistant that an attacker can silently reprogramme is not.

What Apple's change will and will not fix

What it addresses: accidental and semi-informed consent. Making a permission require very explicit action means fewer people grant it by reflex, and more understand what they handed over. That is a genuine improvement and it is cheap.

What it does not address: the underlying asymmetry. A permission that sidesteps every other privacy control on the system is still a permission that sidesteps every other privacy control. Tying the click harder to an informed decision does not change what the click means. If a user grants it — or an agent convinces a user to grant it — the blast radius is identical.

What it does not address at all: the in-app side of the problem. Apple is changing the OS permission dialog. It is not changing what Muse does once it holds the permission, and it is not fixing the 0-day class of bug where an assistant's own settings can be rewritten by other local software. Wardle's finding was that any app could control Muse's settings; a stricter FDA grant flow does nothing about that.

What is genuinely new: Apple has now publicly stated that agent capability is a reason to change a core privacy control. That is a platform-level position, and it is the first concrete regulatory pressure any of this agent-hubbub has produced. Ars Technica's own conclusion is the fair summary: the events "suggest that Muse may not be worthy of the extraordinary access it must have to work as billed by Meta."

What to do on your own Mac this week

• Audit the list now. Open System Settings > Privacy & Security > Full Disk Access and read every entry. If you do not recognise an app, remove it. This list is where agents live, and it is the only place that shows the truth about what you have handed over.
• Re-audit after every agent install. Installing an agent that needs system access is the moment to check, not a quarterly chore. New agent apps are exactly the kind of "developer using Full Disk Access" Apple just described.
• Treat cloud dictation and messaging as one permission, not two. Wardle's core point is that FDA subsumes everything else. If your agent has FDA, assume it can read your messages regardless of what its own settings claim.
• Update Muse and any agent you have running. If you use one with local settings exposure, a patched version matters more than a permission dialog.
• Do not try to be clever with scoping. There is no partial Full Disk Access. The only real control is whether the app is on the list at all.

Bottom line: Apple has now said out loud that agent capability makes a core macOS permission dangerous, and that is a more meaningful intervention than anything the industry has done on this in a year. But a harder click on an all-or-nothing permission is mitigation, not a fix. Audit your Full Disk Access list, and treat any assistant that holds it as having everything it can reach — because by Wardle's account, it does.

Prices and benchmark figures are standard published rates as of October 4, 2026 and can change without notice. Some outbound links may be affiliate links — see our disclosure. Found an error? Tell us and we'll correct it in public.