Short answer. On 2 October Apple said it is tightening how macOS grants Full Disk Access, naming the growing autonomy of AI agents as the reason. The permission opens the whole disk to an app: files, mail, messages, browsing history. Apple adds that for communication apps it also exposes the privacy of the people the user was writing to. It is granted locally, it never reaches your company's admin console, and no OAuth scope limits it. Permissions have to be checked in two places.
We have written three times about what an agent may reach. All three were about one level, and an operating-system vendor has just pointed at the other.
Apple is turning a checkbox into a deliberate act
The permission stays. What changes is how hard it becomes to hand over by accident.
On 2 October 2026 Apple published a developer update. It will add controls to Full Disk Access, and the reason Apple gave is unusually direct.
"Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems, including files, mail, messages, and even browsing history, without users' full knowledge and understanding." The new controls will ensure that users "who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action." And then: "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."
The Verge, TechCrunch and MacRumors all covered it the same day.
Full Disk Access is a macOS permission that hands an app the user's entire system. Apple says it "sidesteps" the privacy controls around it, and Apple built it so that backup software could work. Companies now hand a backup permission to software that acts on its own.
One sentence in that update does more work than the rest, and almost every summary dropped it.
"For communication apps, this can also compromise the privacy of the people users are communicating with."
Read that sentence twice if you handle other people's correspondence. An accountant, a corporate services firm, a brokerage, a clinic: most of the mail and messages on that laptop belong to a client, and no client granted anything.
Two more things the coverage makes clear. Apple has not said when the change ships, and until it does, the permission works exactly as it always has. And Apple named no product. The update landed days after two always-on agents went out, Meta's Muse on 8 September and OpenAI's Dots on 29 September, and the connection between those launches and Apple's timing is something reporters drew, not something Apple wrote.
Where did this come from?
From a dispute about what one agent did on one Mac, and that dispute is not about anybody's memory.
Writing in Inc on 19 September, Jason Aten said he installed Meta's Muse on his iPhone and a Mac and declined to give it access to his messages during setup. Days later Muse sent him a push notification suggesting that a conversation he had just had with his podcast co-host would make a good column, and flagged a message from his editor about a deadline.
He asked Muse how it knew. The agent answered that the Mac app was relaying notification previews and nothing more.
"It's the incoming notification stream only, not access to your texts."
That answer was wrong. Aten then found Muse had synced his local Messages database as far as row 187,462. Reading that database requires Full Disk Access, and he reported that Full Disk Access showed as switched off in Muse's own settings.
Meta disputes the account. Andy Stone, its communications executive, wrote on X that the Messages integration in the Muse app for Mac is "entirely opt-in" and that enabling it requires both Full Disk Access and the Messages connector. David Singleton, who leads Meta Superintelligence Labs, set out the same sequence of steps on Threads.
So the two sides disagree about the state of a machine. Meta's position amounts to saying that what Aten describes could not have happened. Aten's position is that it did, that the Messages connector showed as enabled, although he declined it, and that Meta has not explained how. From the outside neither claim can be settled, and this article does not try.
What does transfer is the part before the dispute began. Asked to account for its own access, the agent gave a specific, confident and incorrect answer. Whether that was a guess dressed as a fact or something worse, the lesson for a company of twenty is the same: an agent is not a witness to its own permissions. The list in system settings is.
Why does none of this show up in the admin console?
Because it is a permission belonging to the operating system, not to an account.
An OAuth scope is a contract between a service and an app: this app may read your mail, that one may write to your calendar. Somebody clicked "allow" on a screen, the service wrote it down, and it can be revoked centrally. The list is the same for everyone in the company. That is the level we covered in the piece on minimal rights for agents, and it is the level most advice stops at.
Full Disk Access is a different contract, between a person and their laptop. Whoever was using the machine granted it, in system settings, and no service was involved, so no service recorded it. The scope language does not apply either, because the agent is not asking a provider for anything. It is reading a disk.
The practical consequence is small and annoying. A company with twenty laptops has twenty separate lists, each visible only on its own machine, and the only way to see them is to look at twenty machines. What the account level exposes is whatever sits inside a granted scope; what this level exposes is files, mail, messages and browsing history, all of it at once.
Which tools were connected in the first place is the question underneath this one, and we went through it in who in your company has already connected AI to your data.
What do you check on the machine?
One list, and one question for each line in it.
On macOS the list lives in System Settings, under Privacy and Security, Full Disk Access. Windows has no single equivalent list and the mechanics are different enough that guessing at them here would not help; that one needs its own piece, written against Microsoft's documentation.
For each application in the list, ask what job needs the whole disk. Three answers come up, and only one of them justifies the permission.
- A backup tool. This is what the permission was built for, and it is the one case where the answer is yes. Carbon Copy Cloner, SuperDuper, ChronoSync and Arq have all needed it for years. Check that the entry is the tool somebody chose, and that it is current.
- An AI assistant or agent. Ask what it is summarising or searching. If the answer is a mailbox or a folder, it needs that mailbox or folder, and a narrower permission for exactly that exists. Full Disk Access is a shortcut past having to decide.
- Something nobody recognises. An employee installed it, used it twice and forgot about it. Revoke the permission, and if something breaks, the employee will say so within a day.
When a tool genuinely needs broad local access, the honest move is to put it on the company account, write down what it reaches, and review it with everything else. That decision looks the same as the one for any connection, and we described it in what access an agent should have when nobody owns security.
What this means for your operation
- Permissions live at two levels. Closing the admin console leaves the laptops untouched, and most companies stop there.
- The local list has no central view. Twenty laptops means twenty checks, done by hand, and that is the whole cost.
- On a laptop that handles client correspondence, the data exposed is mostly not the employee's. Apple put that in writing; it is the line to quote when somebody asks why this matters.
- Do not audit an agent by asking it what it can reach. Read the list.
- Apple's tightening is announced, not shipped. Nothing about the current permission has changed yet.
We connect agents to client mail, CRMs and document stores, and the permission set is a decision we make on every connection, including what the agent may reach on the laptop itself. How that decision works is on the AI integration page. One thing you can do before talking to anyone: open the Full Disk Access list on your own laptop and read what is in it.
Danil Ivanov
Founder, KAIVIX
Builds AI systems for companies in the UAE and beyond.