Full Disk Access: Apple's Essential Warning on AI Agents

Full Disk Access is the macOS permission that lets an app read almost everything on a Mac, and on 2 October 2026 Apple said AI agents have made it too risky to hand out casually. In a notice to developers titled “Updates to Full Disk Access in macOS”, Apple warned that some apps use the permission “in ways that could put users at risk” and promised “additional controls” so that people can only grant it with “very explicit user action”.

The warning lands days after an Inc. columnist said Meta’s Muse agent synced his private Messages history even though he believed he had not given it access. Meta disputes that. Apple did not name Meta, or any other company, but it was blunt about the direction of travel: “As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.”

This guide explains what Apple announced, what Full Disk Access actually unlocks, why agents change the risk, what happened in the Muse dispute, which agent apps ask for the permission, and what Mac users and IT teams should do now.

Table of contents

What Apple Announced
What Full Disk Access Actually Unlocks
A Short History of Full Disk Access
Why AI Agents Changed the Risk
The Muse Dispute That Preceded the Notice
Which Agent Apps Ask for Full Disk Access
What “Very Explicit User Action” Could Mean
What Mac Users Should Do Now
Questions to Ask Before Granting Full Disk Access
What IT Teams Should Do
What Apple’s Notice Means for Developers
Full Disk Access FAQ
References and Further Reading

What Apple Announced

Apple’s notice is short, and it is worth reading in full, because every sentence matters.

The notice in Apple’s words

“We give developers powerful APIs to build incredible capabilities into their apps for Apple products, backed by a set of controls designed to protect users’ private data. Full Disk Access largely sidesteps these controls in order to allow backup apps to function properly on the Mac. Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding.”

The promise

“Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action. Addressing this is critical.” Apple ends by saying it wants users to “clearly understand these risks before granting such access”.

What it did not say

Apple gave no date, no macOS version and no description of the new controls, as both TechCrunch and Engadget noted. It is not banning AI apps from requesting Full Disk Access. It is adding friction, and putting developers on notice.

What Full Disk Access Actually Unlocks

Most Mac users have clicked through a Full Disk Access prompt at some point without thinking about what it means.

Apple’s own definition

Apple’s Mac User Guide says Full Disk Access lets apps “access all files on your computer, including data from other apps (for example, Mail, Messages, Safari, and Home), data from Time Machine backups, and certain administrative settings for all users on this Mac”. That is about as broad as a permission can be.

Built for backup tools

Apple says the permission exists “to allow backup apps to function properly”. A backup tool genuinely needs to read everything, including other apps’ private data, or it cannot restore your Mac. Security and anti-malware tools often need it for similar reasons.

Why it sidesteps the normal controls

macOS normally splits access into narrow permissions that you grant one at a time. Full Disk Access cuts across them.

Permission	What it covers	Scope
Contacts, Calendars, Photos	One type of personal data each	Narrow
Files and Folders	Specific locations such as Desktop, Documents or Downloads	Narrow
Accessibility	Controlling other apps’ interfaces	Powerful, but different
Full Disk Access	All files, plus Mail, Messages, Safari and Home data, Time Machine backups and some admin settings	Everything

A Short History of Full Disk Access

The permission is older than most of the agents now asking for it.

Introduced with macOS Mojave

Apple added Full Disk Access in 2018 with macOS Mojave, when it started requiring user consent before apps could read sensitive data such as Mail, Messages and Safari history. Before then, an app running under your account could read much of that data freely. Mojave split it off and put it behind a list that only you could change.

Granted by hand, not by pop-up

For most sensitive data, such as the camera or contacts, macOS shows a simple pop-up the first time an app asks. Full Disk Access works differently. An app cannot trigger a standard prompt for it. Instead it usually opens System Settings and asks you to switch it on yourself, which is why agent apps often include step-by-step onboarding screens.

Why that is not enough any more

The manual process was meant to be a speed bump. In practice, users follow onboarding instructions without reading them, especially when an exciting new agent promises to do more once it has access. Apple’s notice is an admission that the speed bump has worn flat.

Why AI Agents Changed the Risk

Full Disk Access has existed for years. What is new is the kind of software asking for it.

Agents read, decide and act

A backup app copies data and does nothing else with it. An AI agent reads your data, decides what is relevant, and can act on it: drafting replies, booking things, sending files. Giving an agent Full Disk Access means giving a system that makes its own choices a view of your whole digital life.

Content can become instructions

Agents also read untrusted content, such as emails and web pages. If a message contains hidden instructions, a poorly guarded agent may follow them. Security researchers call this prompt injection. With Full Disk Access, a successful attack could reach far more than one mailbox. Our earlier report on a Muse security vulnerability and Meta’s stronger warning shows these risks are not hypothetical.

Other people’s messages too

Apple made a point that is easy to miss: “For communication apps, this can also compromise the privacy of the people users are communicating with.” When you grant an agent access to Messages, you expose your friends’, family’s and clients’ words as well. They never agreed to anything.

A worked example

Imagine an agent with Full Disk Access that helps you manage email. An attacker sends a message with hidden text telling any AI reader to search for files named “passport” and email them out. A well-built agent ignores it. A poorly guarded one may not, and with Full Disk Access it can reach your documents, not just your inbox. This is a hypothetical, but it shows why broad access and untrusted content are a risky mix.

The Muse Dispute That Preceded the Notice

Apple did not cite any incident, but the timing follows a public row about Meta’s Muse agent for Mac.

What Jason Aten reported

In a column published on 19 September, Inc. writer Jason Aten said he installed Muse on an iPhone and a Mac mini and declined Messages access during setup. Days later Muse suggested a column based on a conversation with his podcast co-host and flagged a message from his editor. According to The Next Web, he found Muse had synced his Messages database “up to row 187,462”, while Muse’s settings showed Full Disk Access switched off.

What Muse told him

When Aten asked how it knew, Muse said it had only seen the text of incoming notification banners. Meta later said that explanation was wrong.

What Meta said

Meta’s head of communications, Andy Stone, wrote on X: “Let’s set the record straight: the Messages integration in the Muse app for Mac is entirely opt-in. You have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content. It can’t read your Messages unless you do this.” David Singleton of Meta Superintelligence Labs said reading Messages takes “three separate steps of app and macOS permissions” and that macOS protections “cannot be bypassed even if the Muse app had a bug”.

What remains unresolved

Aten says Full Disk Access was off and his texts synced anyway. Meta says that cannot happen. No public technical explanation has settled it. Either way, the episode showed how few users can tell, after the fact, which app has which permission.

How fast it moved

Date (2026)	Event	Source
19 September	Aten’s Inc. column says Muse read his messages	Inc.
28 September	AppleInsider reports the claim	AppleInsider
30 September	Meta’s Andy Stone and David Singleton respond	The Next Web, Yahoo Tech
2 October	Apple publishes “Updates to Full Disk Access in macOS”	Apple Developer

Days from each event to Apple’s notice (bar length relative to 13 days)

From Aten’s column (19 Sep): 13 days

From AppleInsider’s report (28 Sep): 4 days

From Meta’s response (30 Sep): 2 days

The counts are 11 + 2 = 13 days, 2 + 2 = 4 days and 2 days. Scaled against 13, the bars are 4 ÷ 13 = 30.8% and 2 ÷ 13 = 15.4%. Apple moved within a fortnight of the first report.

Which Agent Apps Ask for Full Disk Access

Muse is not alone. Engadget wrote that “desktop clients for AI agents, like OpenClaw, Dots and Muse, often encourage users to grant ‘Full Disk Access'”.

OpenClaw, Dots and Muse

OpenClaw is a popular open-source agent. Dots is OpenAI’s new paid agent, and Muse is Meta’s free one; we compared the two in OpenAI’s Dots against Meta’s Muse. All three get more useful the more they can see, which is exactly why they ask for broad access.

Messages is the prize

There is no Apple API that lets third-party apps read iMessage history. Agents that want it usually rely on reading the local Messages database, which sits behind Full Disk Access. That is why the same permission keeps coming up, as in our report on Google testing an Apple Messages integration for Gemini.

The dedicated Mac mini

Engadget also notes that “some people opt to use agents on dedicated machines, which has helped fuel Mac Mini shortages this year”. Running an agent on a separate computer with only the data it needs is a sensible way to limit the damage if something goes wrong.

What "Very Explicit User Action" Could Mean

Apple has not described the new controls, so anything here is informed guesswork rather than reporting.

More than one click

Today, granting Full Disk Access means opening System Settings, finding Privacy and Security, switching an app on and approving the change as an administrator. Apple could add extra confirmation screens, clearer warnings that list exactly what becomes readable, or a short waiting period before the grant takes effect.

Reminders after the fact

Apple could also remind users periodically which apps hold Full Disk Access, so that a permission granted months ago does not stay forgotten. That kind of review would have helped in the Muse case, where the user and the vendor disagree about what was switched on.

Pressure on developers

The notice was published on Apple’s developer news page, not as a consumer announcement. That suggests Apple wants developers to stop nudging users towards Full Disk Access before the new controls arrive, and to use narrower permissions where they can.

What Mac Users Should Do Now

You do not need to wait for Apple’s changes to reduce your exposure.

Check who has Full Disk Access

Open System Settings, choose Privacy and Security, then Full Disk Access. You will see every app that holds the permission. Many people find old installers, utilities they no longer use, or agent apps they forgot they tried.

Remove what you do not need

Switch off any app that does not clearly need to read everything. Backup tools and some security software do. Most AI assistants do not, unless you have chosen a feature such as reading Messages and you understand the trade-off.

Separate your agent from your life

If you want to experiment with powerful agents, use a separate user account or a separate Mac with only the data the agent needs. It is the same instinct behind the dedicated Mac minis Engadget describes.

Prefer narrow connectors

Where an agent offers a scoped connector, such as access to one calendar or one folder, use that instead of Full Disk Access. Narrow permissions limit what a mistake, or an attacker, can reach.

Questions to Ask Before Granting Full Disk Access

Whether you are an individual or a business, a few questions will tell you a lot about an agent that wants Full Disk Access.

Why does it need it?

Ask the vendor which feature needs Full Disk Access and whether the rest of the product works without it. Often only one feature, such as reading Messages, depends on it, and you can live without that feature.

What does it read, and where does it go?

Find out whether the agent processes data on your Mac or syncs it to the vendor’s servers. Aten’s complaint was not only that Muse could read his messages, but that it had synced his Messages database. Synced data is much harder to take back.

Can it work with narrower permissions?

Some agents can use Files and Folders access for specific folders, or individual connectors for mail and calendars. If a narrower path exists, use it.

How do you revoke access and delete data?

Switching off Full Disk Access stops future reading, but it does not delete anything already copied. Ask how to remove synced data from the vendor’s systems, and test that the process works.

Watch for onboarding nudges

Many agent apps walk you through granting Full Disk Access during setup, with arrows pointing at the right switch. Slow down at that step. Ask whether you need the feature it unlocks, and skip it if you are unsure. You can always grant access later.

Check again after big updates

Permissions can outlive their purpose. Make a habit of reviewing the Full Disk Access list after major macOS updates and after trying any new AI tool, and remove anything you no longer use.

What IT Teams Should Do

For organisations, Full Disk Access is a policy question as much as a technical one.

Use device management carefully

Apple’s deployment guide says the Privacy Preferences Policy Control payload can grant “System Policy All Files”, the managed form of Full Disk Access, on supervised Macs. That is useful for backup and security tools. It should not be used to pre-approve AI agents for staff. Our device management team helps firms set these profiles up safely.

Write an AI agent policy

Decide which agents staff may install on work Macs, what data they may touch and who approves exceptions. Treat Full Disk Access requests from agents as high risk by default. A clear policy is part of good IT security, alongside general cybersecurity training.

Remember the people in the messages

Under UK GDPR, the messages on a work Mac contain personal data about clients, suppliers and colleagues. An agent that can read them all creates a processing activity your business must be able to justify. Apple’s warning about “the people users are communicating with” applies directly.

What Apple's Notice Means for Developers

Apple published its warning on the developer news page, so developers are the first audience.

Ask for less

The clearest message is that broad access should be a last resort. Developers who request Full Disk Access by default, rather than when a user turns on a feature that needs it, should expect that pattern to get harder.

Explain the request

If an app genuinely needs Full Disk Access, it should say exactly what it will read and why, in plain language, before sending the user to System Settings. That is good practice now, and it will likely fit whatever controls Apple adds.

Prepare for change without a date

Apple gave no timeline. Developers should assume the new controls could arrive in any future macOS update and design onboarding that still works if granting access takes extra steps.

Full Disk Access FAQ

What is Full Disk Access on a Mac?

It is a macOS permission that lets an app read all files, including data from Mail, Messages, Safari and Home, Time Machine backups and some administrative settings. Apple designed it for backup apps.

What did Apple announce?

On 2 October 2026 Apple said it will add controls so that users can only grant Full Disk Access with “very explicit user action”, because AI agents make the permission riskier.