Highlights potential data privacy and security risks when deploying desktop AI agents that require deep system access.
What Is macOS Full Disk Access and What Is Apple Changing?
Full Disk Access is a macOS permission that gives an app reach across files, mail, messages, and even browsing history, and Apple’s Mac User Guide shows where users grant or revoke it. The feature was built so backups could run, not to feed AI agents.
Apple announced it is introducing additional controls around the setting because AI agents have increased the risks that come with this level of access. In a blog post aimed at developers, the company said some developers are using Full Disk Access in ways that could put users at risk by exposing everything on their systems without their full knowledge and understanding.
The change lands in the middle of an agent boom. Desktop AI agents control things on your system and read your files and messages, which is the reach the setting grants.
The permission your backup needed is now the permission your AI tools want, and Apple is tightening the handoff.
Did Meta’s Muse App Actually Read Private Messages?
The catalyst was a claim, and the claim is disputed. Inc. columnist Jason Aten reported that Muse knew the content of his private messages even though he said he never gave the AI agent permission, and Meta disputed that account.
The report still did its job. It raised the question of what level of security and trust users should grant desktop-based AI, and Apple’s announcement followed within days of the claim going public.
The setting itself explains how the reach works. Muse lets users switch on Full Disk Access, and once granted, the app can read files, mail, messages, and browsing history in the background of whatever task you assigned.
Treat the Muse story as unproven but instructive: the disputed claim is what pushed the permission model into the open.
How Is the New Full Disk Access Control Different From the Old Setting?
The old flow asks once and remembers forever. Users who genuinely wish to grant an app this extraordinary level of access will now need to do so only with very explicit user action, according to Apple’s developer post.
The company’s framing goes further: as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially, and Apple says it is committed to making sure users understand those risks before granting access. A separate report on Muse’s debut shows how fast consumer agents arrived at this threshold.
Apple did not respond to TechCrunch’s inquiry about the feature change, so timing and mechanics remain unstated. A cited Wired report on a ChatGPT Mac app flaw that could have let hackers access sensitive data gives the security context behind the push.
The shift is from a forgotten checkbox to a deliberate grant, and that is a structural change for every app that wants deep reach.
The fitness apps my clients use ask for contacts, health metrics, and location in 1 scroll of checkboxes. Most people tap accept without reading, because the phone is already in their hand and the workout is starting.
The list never gets audited until something breaks. By then the app has held the data for months, and the removal is a formality.
Your Mac runs the same pattern with bigger stakes. Full Disk Access is the accept button for your whole business, and Apple is making that button harder to hit.
What Does the macOS Change Require a Small Business to Do?
Audit the Full Disk Access list on every Mac your team uses, because the apps already holding the grant are the exposure. The new controls will govern future grants, while existing grants sit there until you remove them.
Pay attention to which agents need disk-level reach for the task you hired them for. Meta expanded Muse to small businesses days before this story broke, so the agent asking for deep access is already installed on someone’s work laptop.
The small-business expansion is the part that makes this operational rather than theoretical. AI agents are arriving on the same machines that hold client files, invoices, and browser sessions.
The audit matters more than the new dialog, because existing grants do not revoke themselves.
What Should You Do About AI Agent Permissions Now?
Open System Settings, open Full Disk Access, and remove every app that does not need that visibility to function. Keep backups and the 1 or 2 tools with a stated reason, and re-grant on purpose when an agent earns it.
Write the review into your schedule: every quarter, 15 minutes, every machine that touches client data. Least privilege is the mechanism that generalizes here, whether the tool is an AI agent, a backup utility, or a browser extension.
When the new explicit-action flow ships, use it as a forcing function and re-confirm each app on purpose. If you want the wider context, our archive holds the other AI privacy fights we are tracking.
Prune the list today, review it every quarter, and make every future grant a decision instead of a default.
Source: TechCrunch AI
