Apple reins in AI agents on the Mac: full access to your data will require explicit permission

By Zendoric · October 2, 2026.

Apple announced on Friday that it will tighten macOS privacy controls to limit what third-party software can see on a Mac. The change points directly at AI agents: from now on, granting "Full Disk Access" —the permission that opens system files, email, messages and complete browsing history— will require "a very explicit user action," according to Apple's statement reported by Bloomberg. The company did not name specific apps, but was clear in its diagnosis: some developers have used that access "in ways that could put users at risk" without users fully understanding what they were authorizing.

The case that best illustrates the problem came from OpenAI itself in August, when it added to ChatGPT for Mac an optional feature to read, summarize, write and send messages on the user's behalf. To work, it needs full disk access so it can read conversations in Apple's Messages app. Apple also points to a nuance that usually goes unnoticed: when an agent reads all your messages, it also exposes the privacy of the people you talk to, who never consented to anything.

Apple is not moving in a vacuum. OpenAI announced this week that its tools —among them ChatGPT Work and Codex— now top 35 million users, up from 10 million in July: a 3.5-fold increase since then. In parallel, Muse, Meta's agent app, led app store downloads last month right after launching. AI agents —software able to act for the user without constant supervision— have gone from curiosity to mass-market product almost overnight, and that is exactly what has set off alarms in Cupertino.

Our read is that Apple is doing here what it does best: becoming the trusted arbiter of a layer it does not directly control. It does not build the most powerful agents on the market, but it does build the operating system they run on, and that gives it the final word on what they can see. It is the same pattern of power it wields with the App Store, now applied to data permissions: whoever controls the entry point controls the pace at which the industry can move, whether OpenAI or Meta like it or not.

In the short term, this introduces real friction for the most ambitious agents. An assistant that needs to read your messages to summarize them or reply for you will depend on the user understanding and accepting, step by step, a risk that until now was granted with a single, almost blind click. That slows adoption of the most invasive features and forces agent developers to design more granular permissions —access to a single folder, a single app, a single conversation— instead of asking for the master key to the entire disk.

In the long term, however, this kind of guardrail is precisely what is needed for autonomous agents to end up handling genuinely sensitive tasks: medical records, personal finances, private communications. The promise of an AI that frees up time and expands what we can delegate only holds if there is an auditable architecture of trust underneath: explicit consent, limited scope and traceability of what each agent saw and when. Without that, a single mass-leak scandal is enough for public distrust to bring adoption of agentic AI to a dead stop for years, just as it is closest to becoming truly useful. Apple, with its record of imposing privacy standards on the rest of the sector —from location permissions to ad-tracking blocking— will probably not be the last platform to put up this kind of wall; it is more likely that Microsoft and Google follow a similar path as soon as their own agents start asking for the same keys.