Apple tightens Full Disk Access after Meta's assistant read private messages: a permission built for backups meets AI agents

Apple is moving to restrict how third-party software — AI agents above all — can reach personal content on macOS. The company announced it will add further controls around Full Disk Access, the system permission that grants an application read access to essentially everything on the machine. According to Ars Technica, as reported by Geeknetic, the decision follows the controversy over Meta's Muse assistant, which generated an alert referencing a user's private conversation in the Messages app without explicit authorization for that use.

The factual dispute is worth separating carefully, because the two sides are not arguing about the same thing. Meta's chief technology officer, David Singleton, denied any technical violation, stating that the assistant consults data only if the owner enables two independent permissions: a specific connector inside Meta's own tool, plus the macOS disk permission. Patrick Wardle, a macOS security specialist, rebutted that: once Full Disk Access is granted, the technical barrier is gone, and any process can read chat databases, browsing history and cookies without root privileges. Note what each is describing. Singleton is describing his product's interface. Wardle is describing the operating system's permission semantics. The researcher's point is that the first is a promise and the second is a capability — and only one of them is enforced by the machine.

Apple's own statement, published for developers, is unusually direct. It says Full Disk Access "largely bypasses" the company's privacy controls and exists so backup applications can work; that some developers use it in ways "that could put users at risk", exposing files, mail, messages and browsing history "without their full knowledge or understanding"; and that for communication apps this "can also compromise the privacy of the people users communicate with". Going forward, Apple says, granting that level of access will require an explicit action. The forward-looking sentence is the one that matters: "As AI agents become more capable and autonomous, the risks associated with this level of access will increase considerably." Apple never names Meta.

Here is the structural problem, and it is bigger than either company. Desktop permissions were designed for passive software: you open an app, it does a thing, it closes. An agent is not that. It runs in the background, continuously, and decides for itself what is relevant. A consent given once — to let a backup tool copy your drive — becomes a standing license for an autonomous process to read your life. And the third-party consent gap is the sharpest edge: in the Muse incident, as described, the messages involved other people, and none of them agreed to anything at all. Consent on behalf of someone who is not at the keyboard is not consent.

Our read: this is the useful kind of friction, and the direction is right even though Apple's motives are not purely civic. Cupertino controls the platform and competes directly in on-device AI; a privacy rule that constrains a rival's assistant also defends Apple's own turf. Acknowledge that, then notice it does not make the argument wrong. We have been tracking a consistent pattern this year: agent security keeps sinking down the stack, from prompts to runtimes to hardware isolation, because instructions do not contain software that can act. Permissions are the next layer to fall. Judge any agent governance proposal by where the control actually lives, not by what the vendor's settings screen says.

And judge this against the long horizon, because the horizon is what is at stake. Agents that read your mail, your files and your calendar are precisely how AI stops being a chat window and starts giving people their hours back. That future requires permissions that are scoped, auditable and revocable — "this agent may read the last twenty messages in this thread", not "this agent may read the disk". Rebuilding that layer now is slow, annoying, and the only way the useful version ever gets trusted enough to ship.