Apple has told Mac developers that granting an app Full Disk Access will soon require “very explicit user action.” The company gave no date and no description of the new controls, but it did give a reason. Apple said the risks of this level of access “will grow substantially” as AI agents become more capable and autonomous.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Full Disk Access is the macOS permission that lets an app see nearly everything stored on a computer, including mail, messages and browsing history. It was built for a narrow purpose, and the announcement, made Oct. 2, 2026, came days after disputes over AI apps on the Mac put the permission in the spotlight.
What Apple’s developer post says
In a short post on its developer news feed, Apple explained that Full Disk Access “largely sidesteps” the privacy controls that normally protect user data, in order to let backup apps work properly on the Mac. It added that some developers are using the permission in ways that could put users at risk, exposing files, mail, messages and browsing history without users’ full knowledge and understanding. For communication apps, Apple said, the exposure can also reach the privacy of the people on the other end of a conversation.
The company’s fix is to add controls so that users who genuinely wish to grant an app this extraordinary level of access can do so only through very explicit user action. Apple called addressing the problem critical, and said it is committed to making sure users understand the risks before they grant the access, so they can make informed decisions about their own data.
The post does not say what the new controls look like, when they arrive, or whether existing grants will be revisited. It also lists no required steps for developers. Backup, sync and messaging tools that depend on the permission should expect stricter consent prompts, but the details will have to come from future macOS release notes.
The Meta Muse dispute that preceded it
TechCrunch’s report on the change points to a controversy that broke days earlier. Inc. columnist Jason Aten wrote in a Sept. 19 column that Meta’s new Muse AI agent knew the content of his private messages even though he said he had declined to give it access. He said Muse suggested a column based on a podcast conversation and flagged a message from his editor, and that Full Disk Access was not enabled for Muse on his Mac.
Meta disputed the claim. Andy Stone, Meta’s vice president of communications, said on X that the Messages integration in the Muse app for Mac is entirely opt-in and that users must switch on both Full Disk Access and the Messages connector before the app can read messages, as TechCrunch recounted in its earlier coverage of the dispute.
David Singleton, an executive at Meta Superintelligence Labs, replied on Threads with a three-step description of app-level permissions and macOS system protections that he said could not be circumvented even if Muse had a bug. Aten, for his part, argued that an agent should clearly ask before touching private messages. TechCrunch noted that many people doubt Meta’s account given its history of consumer data problems.
Aten’s column adds texture to his side of the story. He wrote that when he asked Muse how it knew, the agent replied that it only received text from incoming notification banners and could not open the Messages app or read history. His own investigation, he said, found that Muse syncs from the local Messages database and uploads it as a source, with the sync on his device reaching row 187,462. Meta told him the app was built to be a safe, secure, private personal AI agent.
Singleton’s explanation was specific. Users choose a Messages access level of None, Read only or Read, and those options are grayed out unless Full Disk Access is enabled. Turning on Full Disk Access sends the user to macOS Settings for a separate confirmation, and Muse then restarts completely. Singleton said the AI’s own account of what it was doing was confused and incorrect, and pointed to Muse’s security architecture page and its bug bounty program.
A permission that was never meant for AI agents
A Wired report on a flaw in OpenAI’s ChatGPT Mac app, which could have let hackers reach sensitive data, was the other incident TechCrunch cited alongside the Muse dispute. Together they make Apple’s argument concrete: an assistant that can act on a person’s behalf is most useful when it can read everything, and most dangerous for the same reason.
Apple did not respond to TechCrunch’s request for comment. TechCrunch also corrected its original framing: the change is about informed consent, not a new limit on what apps can request. Until the controls ship, the safeguard on a Mac remains the one Apple describes, a deliberate decision by the person at the keyboard to hand an app everything.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
