Apple moves to lock down Full Disk Access — the first real rule of the agent era is a permissions rule

Apple plans to tighten macOS privacy policy so third-party tools — AI agents above all — can no longer quietly read the entire contents of a machine. According to Ars Technica, cited by Geeknetic, the decision follows the controversy over Meta's Muse assistant, which reportedly generated alerts based on a user's private conversations without explicit authorization.

The incident surfaced when a journalist reported that Meta's assistant sent him a notification referring directly to a conversation held in the Messages app. Meta's chief technology officer, David Singleton, denied any technical violation and said the assistant only consults data if the owner enables two independent permissions: a specific connector inside the tool, plus the macOS disk permission. That explanation was contested by macOS security researcher Patrick Wardle, who argued that granting Full Disk Access removes any technical barrier at all — any process can then read files without root privileges, including chat databases, browsing history and cookies. For the research community, the permission grants indiscriminate read access to any local file regardless of what file pickers the app shows in its interface.

Apple has now intervened publicly, and its developer statement is unusually direct. Full Disk Access, the company says, "largely bypasses" its privacy controls so that backup applications can work; some developers use it "in ways that could put users at risk, exposing the entire contents of their systems — including files, mail, messages and even browsing history — without their full knowledge or understanding." For communication apps, Apple adds, this also compromises the privacy of the people the user talks to. Going forward, the company will require an explicit action to grant that level of access. The closing line is the one to keep: "As AI agents become more capable and autonomous, the risks associated with this level of access will increase considerably."

That is the heart of it. The macOS permission model was designed for applications, which ask for a file when a human clicks something. An agent is a different animal: it reads continuously, infers across sources, and acts without a human in the loop for each step. A permission that was an acceptable trade-off for a backup utility becomes a standing surveillance license when handed to software that never sleeps. And the consent problem is worse than it looks — as Apple notes, and as the Muse episode illustrates, the messages read belonged to conversations involving third parties who never agreed to anything.

Our read: this is the most consequential piece of AI governance of the week, and it is not an AI law. It fits a pattern we have been tracking — the effective brakes on these systems are arriving through pre-existing general structures (consumer law, courts, and now operating-system permission models) rather than through bespoke AI statutes. Apple's motives are not purely civic, of course: tightening the screws on a rival's assistant is also competitive strategy, and a platform owner defining the rules for everyone else's agents is its own concentration-of-power problem. Both things are true.

Still, we think the direction is right, and precisely because we are optimistic about agents. The useful ones — the assistant that reconciles your medical records, the one that manages a decade of correspondence — will require deep access to intimate data. That access only becomes socially acceptable if it is scoped, explicit, revocable and auditable, rather than a single master key granted once in a dialog box nobody read. Forcing that engineering now, while the stakes are notifications and embarrassment, is far cheaper than discovering the failure mode later. The short term here is friction for developers; the long term is the trust infrastructure without which agents never get to do the things that actually matter.