Apple is rewriting macOS permissions for the agent era: Full Disk Access was never built for AI that reads everything

Apple is changing how macOS grants Full Disk Access, the permission that lets an app read everything on a Mac. According to Ars Technica, cited by Geeknetic, the move follows a controversy over Meta's Muse assistant, which generated an alert based on a user's private conversations without explicit authorization. A journalist reported receiving a notification from Meta's assistant that referred directly to a conversation held in the Messages app.

The two accounts of what happened do not match. Meta's chief technology officer, David Singleton, denied any technical violation and said the assistant only consults data when the owner enables two independent permissions: a specific connector inside the tool, plus the macOS disk permission. macOS security researcher Patrick Wardle disputed that framing, arguing that granting Full Disk Access removes the technical barrier entirely — any process can then read local files without root privileges, including chat databases, browsing history and cookies. In Wardle's reading, the in-app toggles Meta points to are interface, not enforcement.

Apple's public statement is the most revealing document here. Full Disk Access, the company says, "largely bypasses" its privacy controls so that backup applications can work, and some developers use it in ways that expose "files, mail, messages and even browsing history" without users' full understanding. It then adds the line that matters: "As AI agents become more capable and autonomous, the risks associated with this level of access will increase considerably." Apple says it will require an explicit user action before an app can obtain that access.

The structural problem is older than Muse. Full Disk Access is a 2010s permission model — one binary switch, granted once, designed for a Time Machine clone that reads your files at 3am and tells nobody. An agent is a different animal: it reads continuously, reasons over what it reads, and acts on the conclusions. The same checkbox now authorizes something categorically different. And as Apple notes, the exposure is not only the user's: the Messages database contains the other side of every conversation. Nobody in that thread consented to anything.

Our read: this is the macOS version of a pattern we have been tracking all year — containment for AI agents is migrating down the stack, from prompts and policies into the operating system and the silicon. You cannot instruct an agent not to misuse data it can already read; you have to make the data unreachable. Apple's fix as described is still a consent fix, which is better than nothing but ultimately the wrong layer: a scarier dialog box is not a security boundary. The durable answer is capability-based, purpose-scoped access — an agent that can read the last ten messages in one thread because you asked it to, and nothing else, ever.

Two cautions before we hand Apple the medal. First, the company that most benefits commercially from restricting third-party assistants on its platform is Apple, and privacy and moat point in the same direction here; that does not make the policy wrong, but it should be stated. Second, this needs to end in documented APIs, not just friction — if scoped access is too painful to build against, developers will route around it and users lose twice.

Still, the direction is right, and it matters more than the incident. The long-term case for agents on personal devices — genuinely useful software that handles the administrative sludge of modern life — depends entirely on them being trustworthy with the most intimate data most people own. Getting the permission model right now, while the stakes are an embarrassing notification rather than something worse, is exactly when this work should happen.