Apple just changed the rules for one of the most powerful permissions on the Mac, and it did so because of AI agents. In a notice posted to its developer news site on October 2, 2026, the company said it will introduce new controls so that granting Full Disk Access requires, in its words, very explicit user action. The reason is blunt: as AI agents grow more capable and autonomous, the risks tied to this permission will grow substantially.
The Short Answer
Apple is tightening macOS Full Disk Access so that apps, especially AI agents, can no longer quietly obtain permission to read your files, mail, messages, and browsing history. Going forward, you will have to take a deliberate, explicit step to grant it. The change was announced on October 2, 2026, and Apple has not yet said exactly when the new controls will ship. If you use an AI desktop assistant on your Mac, expect setup to get stricter, and take five minutes now to check which apps currently hold this permission.
What Is Full Disk Access on macOS?
Full Disk Access is a special macOS permission that largely sidesteps the normal privacy controls built into the system. Normally, macOS asks per-app questions: can this app use your camera, your microphone, your photos, your contacts? Full Disk Access goes far beyond those prompts. It exists so that backup applications, which legitimately need to copy an entire drive, can do their job.
Once an app holds it, the surface it can read is enormous: your files, Mail, Messages, Safari browsing history, contacts, photos, and even Time Machine backups. Apple said in its announcement that some developers are now using this permission in ways that put users at risk, exposing everything on their systems without the users full knowledge and understanding.
Why AI Agents Triggered This Change
This is the first time Apple has updated a core macOS permission specifically because of agents. The timing is not a coincidence. The announcement landed days after a public dispute over how a popular AI agent handles message access.
The Dispute That Put Agents Under the Microscope
Inc. columnist Jason Aten reported that the Muse AI agent on his Mac surfaced details from his private Messages history, including a note from his editor, even though he says Full Disk Access was switched off. Meta pushed back, with executive David Singleton saying three separate layers of app and system permissions stand between Muse and a user messages, and that macOS protections cannot be bypassed even by a bug in the app. Apple named no app in its announcement, but the message was clear: the current permission model was not built for software that acts on your behalf.
Reporting around the same time also flagged a potential flaw in the ChatGPT Mac app that could expose sensitive data, adding to the sense that desktop agents are moving faster than the guardrails around them. Tools like Meta Muse and OpenAIs always-on Dots agents are designed to reach deep into your digital life, canceling subscriptions, managing calendars, and summarizing your mail, which is exactly why the broadest permission on the Mac worries Apple.
What Apple Told Developers
Apples developer notice was unusually direct. It said Full Disk Access largely sidesteps the privacy controls designed to protect user data, and that some developers use it in ways that expose everything on a user system, including files, mail, messages, and browsing history. It also flagged a risk most users never think about: the privacy of the people you talk to. For communication apps, Apple wrote, this permission can also compromise the privacy of the people users are communicating with. Your friends messages to you are your messages, and an agent that can read yours can read theirs too.
What Actually Changes
Apple says it will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action. In practice, that likely means the days of granting Full Disk Access with a casual toggle during app setup are over. Apple wants users to clearly understand the risks before granting access, so they can make informed decisions about their own data.
What Apple has not said is just as important. There is no announced release date, and no macOS version attached to the change yet. There is also no description of what the new approval flow will look like, which leaves developers of backup tools, system utilities, and AI agents guessing about how to guide users through it.
How to Check and Audit Full Disk Access on Your Mac
You do not have to wait for Apples update to take control. Here is how to see exactly which apps currently hold this permission:
1. Open System Settings and go to Privacy and Security.
2. Select Full Disk Access.
3. Review the list. For each app, ask whether it genuinely needs to read your entire drive. Backup tools and antivirus utilities usually do. A chat assistant probably does not.
4. Switch off anything you do not recognize or no longer use.
This is a good habit to repeat a few times a year, especially if you install AI-powered apps. Apple tightened its macOS security posture this week on other fronts as well, and keeping your permission lists lean is the simplest protection available.
What This Means for AI Agent Apps
For the growing wave of agentic apps, this is a warning shot. Developers who ask for Full Disk Access during onboarding will face a stricter gate, and users will see stronger warnings about what they are handing over. Some agents may need to redesign around narrower permissions, requesting access only to specific folders or data types rather than the whole disk.
For users, the takeaway is straightforward: treat any request for Full Disk Access like a request for the keys to your digital life, because that is what it is. The rise of AI agents like Meta Muse means more apps will ask for deep access in the coming months. Say yes only when the apps job clearly requires it, and say no by default. The trend toward agent-driven automation, from new decision-model frameworks to always-on assistants, makes this discipline more important, not less.
When Will the New Controls Arrive?
Apple has given no timeline. The announcement simply says it will introduce additional controls in a future update. Given that macOS updates typically ship through the year, developers and users should expect the new approval flow to appear in an upcoming macOS release, possibly tied to further agent-related announcements. Watch Apples developer news feed and the release notes of the next macOS point update for details.
FAQ
Is Full Disk Access the same as normal app permissions on a Mac?
No. Normal permissions are per-app prompts for specific things like the camera, microphone, or photos. Full Disk Access largely sidesteps those controls and lets an app read the whole drive, including Mail, Messages, and browsing history. That is why Apple calls it an extraordinary level of access.
Does this change affect apps I already granted Full Disk Access to?
Apple has not said whether the new controls will retroactively affect existing grants. It is likely that current permissions will stay in place, but auditing them yourself, using the steps above, is the safe move regardless.
Will AI agents stop working on Mac without Full Disk Access?
Not necessarily. Many agents can function with narrower permissions, such as access to specific folders. But agents designed around deep access to your mail, messages, and files may need updates, and their setup flows will become stricter under Apples new rules.
When does the new Full Disk Access control take effect?
Apple announced the change on October 2, 2026, but has not given a release date or named a macOS version. It is expected in a future macOS update.
Does this affect iPhone or iPad?
No. Full Disk Access is a macOS-specific permission. iOS and iPadOS have their own sandboxed permission model and were not mentioned in Apples announcement.
Apples move is a sign of where the platform wars are heading. The defining question of the agentic era is how much of your digital life a piece of software gets to see, and Apple just answered that on the Mac: only with your full, explicit say-so.