Apple turns Full Disk Access into the chokepoint for AI agents — a permission that was never designed for them

Apple is changing how macOS grants Full Disk Access, the permission that lets an app read essentially everything on a Mac, and it says the trigger is AI agents. According to Ars Technica, cited by Geeknetic, the company will add controls so that only users who genuinely intend to hand over that level of access can do so, through an explicit action. The immediate context is the controversy around Meta's Muse assistant, which reportedly generated alerts based on a user's private conversations without explicit authorization.

The sequence matters. A journalist reported that Meta's assistant sent him a notification referring directly to a chat held in the Messages app. Meta's chief technology officer, David Singleton, denied any technical violation, saying the assistant only consults data if the owner enables two independent permissions: a specific connector inside the tool itself, plus the macOS disk permission. macOS security researcher Patrick Wardle rebutted that explanation, arguing that once Full Disk Access is granted, the technical barrier is gone — any process can read files without root privileges, including chat databases, browsing history and cookies. For the research community, the permission is indiscriminate read access to local files regardless of what selectors an app shows in its interface.

Apple's developer statement, quoted in the article, is unusually blunt for the company. It says Full Disk Access "largely bypasses" the controls that protect private data and exists so that backup applications can work; that some developers use it in ways that could put users at risk by exposing files, mail, messages and browsing history "without their full knowledge or understanding"; and that for communication apps it can also compromise the privacy of the people the user talks to. Then the forward-looking line: as AI agents become more capable and autonomous, the risks associated with this level of access will increase considerably.

That last sentence is the whole story, and it is bigger than Meta. The macOS permission model was designed in an era when software did one job per launch: a backup tool copies your disk, a text editor opens a file you picked. An agent is the structural opposite — open-ended goals, background execution, and frequently a remote model on the other end of the pipe. Granting it Full Disk Access is not "let this app read a file," it is "let an autonomous process, acting on instructions you did not write, read everything you have ever stored, forever." The unit of consent is wrong, and the third-party problem makes it worse: nobody in that Messages thread consented to anything, because they were never asked.

Context check before anyone crowns Apple the privacy hero. Apple competes directly here — it sells on-device intelligence and benefits commercially when rival assistants are forced through narrower APIs. A company restricting a permission that mostly constrains its competitors deserves credit for the outcome, not assumed altruism. It is also worth noting where this governance is coming from: not from AI-specific legislation, but from an operating system vendor changing a consent dialog. That has been the pattern lately — the binding constraints on AI behavior are arriving through platform plumbing, consumer law and courts, faster and more concretely than through any AI statute.

Our reading: this is friction in the right place, and short-term pain for agent developers is the price of long-term trust. We want agents that can read our medical records, our calendar and our correspondence — that is literally how a personal assistant becomes a health advocate, and it is part of the path toward cheaper, earlier, better care. But nobody should hand that access to a system that cannot explain what it read, when, and on whose behalf. The technical ask is clear: per-purpose, auditable, revocable, time-bounded permissions, not a single switch labeled "trust me with your entire life." If the agent era forces operating systems to rebuild consent at that granularity, the Muse incident will have bought us something valuable.