Apple tightens Full Disk Access to curb AI agent overreach
Apple announced changes to macOS privacy settings intended to limit how third-party applications access sensitive user data. The update targets Full Disk Access, a system-level permission that grants apps broad filesystem privileges. The move follows public attention on Meta's AI agent Muse, which reportedly sent an unsolicited notification referencing a private conversation in Apple Messages to tech columnist Jason Aten—access Aten said he never knowingly granted.
The incident highlighted a recurring concern: AI assistants with broad system privileges can expose private information users assume is protected. Social media responses amplified the sentiment that these tools, while potentially useful, carry risk when given unrestricted access to calendars, emails, messages, and linked shopping accounts. The comparison to power tools like a skill saw stuck because the damage possible from misuse is real, even if the intent is helpful.
The Muse incident and the two-privilege model
The controversy began when Aten reported that Muse referenced a thread between him and a co-worker over Apple Messages. He stated he never gave the agent permission to read his messages and had assumed such access was off-limits by default.
Meta CTO David Singleton offered a rebuttal that at first seemed to clarify the situation. He explained that for Muse to read Apple Messages content, a user must manually grant two separate privileges. The first is Full Disk Access at the macOS system level. The second is enabling a Messages connector setting inside the Muse application itself. Singleton framed the integration as opt-in: "Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled."
His position implied that Aten had enabled both settings, and that the responsibility fell on the user, not Meta. If both permissions were active, Messages content would be accessible to the agent.
Technical pushback from the security community
Not everyone was convinced by the two-privilege explanation. macOS security researcher Patrick Wardle argued that from a technical standpoint, Full Disk Access grants broad reading power. His position was that with FDA (Full Disk Access), any non-root file is readable—including browsing history, browser cookies, chats, and other data. In his view, the presence of Full Disk Access alone is sufficient for an application to access message databases, regardless of additional connector settings.
When pressed on how Muse could have Full Disk Access yet allegedly not read messages, Meta's public response repeated Singleton's statement without addressing Wardle's technical point. The exchange left a gap between the company's opt-in framing and the broader capability that Full Disk Access traditionally provides.
Apple's response and the policy shift
In response to the discussion and widespread user concern, Apple said it is changing macOS privacy settings to stop third-party app developers from misusing Full Disk Access to access message histories. The specifics of the change were not detailed in the initial announcement, but the direction is clear: the era of unrestricted Full Disk Access for third-party applications is being narrowed.
The timing—announced roughly two weeks after the Muse incident went public—suggests Apple was already moving to address the category of risk the incident brought into focus. By limiting how Full Disk Access can be used, Apple aims to reduce the attack surface available to AI agents and other applications that might scrape or exfiltrate sensitive content.
Broader implications for AI assistant design
The episode has become a reference point for how AI assistants are granted system-level privileges. The narrative that emerged—AI tools as power tools capable of real damage if not used carefully—is likely to influence how both developers and users approach permission granting. Designers of AI agents will need to reconsider whether broad filesystem access is necessary for their use cases, or if more targeted permissions can achieve the same functional goals.
For users, the situation reinforces a cautious approach. Granting Full Disk Access should be treated as a deliberate action with known consequences, not a default or rubber-stamp approval. The Muse case demonstrates that even when an application claims opt-in integrations, the underlying system permission can enable far more than the user might expect.
What changes mean for daily use
Apple's update will likely require developers to request Full Disk Access more judiciously, with clearer explanations of what the permission enables. For end users, it may mean periodic reviews of which applications hold the permission and whether those apps genuinely need such broad access. The change also signals that platform owners are watching how AI agents exercise privileges and are willing to adjust operating-system-level safeguards when patterns of abuse emerge.
Whether the specific implementation narrows FDA to specific containers, adds additional approval steps, or introduces a different mechanism remains to be seen. What is clear is that the boundary between convenient access and privacy overreach is being redrawn, and AI agents are part of what is driving that redraw.