Apple’s Full Disk Access changes show AI agents are becoming an OS security problem

Why Full Disk Access became a flashpoint

Full Disk Access is powerful because it can give a macOS app access far beyond a single file picker, folder grant or application-specific data store. Apple said the setting exists largely so backup apps can function properly, but warned that some developers are using it in ways that can put users at risk.¹

That risk profile changes when the app is an AI agent. A conventional utility may read broad areas of a disk to index, back up or clean files. An agent may do something more expansive: synthesize information across messages, mail, browser state and local documents; trigger workflows; maintain memory; and respond proactively. In other words, the permission is not just read access. It becomes context access.

Recent reports linked Apple’s announcement to concerns around Meta’s Muse app, including a columnist’s claim that the app appeared to know the contents of private messages, a claim Meta disputed.² Ars Technica reported that Meta’s position was that Muse required both macOS Full Disk Access and an enabled Messages connector to read Messages content. macOS security researcher Patrick Wardle argued that Full Disk Access is technically broad enough to read many non-root local files, including chats, browsing data and cookies.³

Apple did not name Meta, Muse or any other developer in its announcement.³ Still, the timing placed the company’s developer notice inside a wider debate over whether users can reasonably understand what they are granting when an always-on assistant asks for operating-system-level access.

The consent model is under strain

Apple’s language points to a gap between formal consent and meaningful user understanding. The company said users who genuinely want to grant an app such access should be able to do so only through “very explicit user action,” and that users must clearly understand the risks before granting it.¹

That framing matters. Traditional permission prompts often ask whether an app may access a category of data or a device capability. Agentic apps complicate that model because the same permission can support many downstream behaviors: summarizing local files, searching messages, extracting attachments, using browser sessions, or acting on a user’s behalf.

The result is a mismatch between the prompt and the system behavior it enables. A user may believe they are authorizing productivity assistance. The operating system may actually be granting a durable capability to inspect a large portion of the local data estate.

Daring Fireball’s analysis captured the platform contrast: iOS and iPadOS do not offer third-party apps an equivalent path to read protected email or end-to-end encrypted messages simply because a user approves every prompt, while macOS can expose far more of the startup drive when broad permissions are granted.⁷

For platform teams, that suggests permission dialogs alone are an inadequate control plane for agents. Future designs may need clearer scope, shorter-lived grants, purpose binding, per-data-source controls, and audit trails that show not only what permission was granted, but what the agent accessed and why.

Auditability becomes as important as authorization

Apple has not said whether its coming changes will include logging, developer attestations, access receipts or new user-visible audit surfaces. But the agentic-app problem naturally pushes platforms in that direction.

If an app with broad access reads a message database, indexes browser history or pulls mail attachments into an embedding store, a one-time prompt is a weak accountability mechanism. Security teams need evidence. Users need intelligible explanations. Enterprise administrators need policy controls that distinguish between backup software, endpoint detection, accessibility tools and AI agents.

This is where desktop operating systems may begin borrowing from cloud security. In cloud environments, high-risk privileges are increasingly paired with just-in-time elevation, session recording, scoped tokens, policy evaluation and logs. Desktop agents create a similar need locally: consent should be narrow enough to express intent, and activity should be observable enough to verify that the agent stayed within that intent.

For enterprises, the issue also intersects with data-loss prevention and insider-risk programs. An agent that can read local messages, documents and browser sessions may become a privileged data broker even if it is not malicious. If compromised, misconfigured or overbroad by design, it can collapse multiple data boundaries at once.

AI apps are becoming high-value local targets

The risk is not limited to intentional overreach by app developers. WIRED reported on a recently patched vulnerability in the ChatGPT macOS app that could have let attackers take over the app on a victim’s computer and reach chat logs, app-stored data and connected browser sessions.⁶ OpenAI acknowledged the flaw and fix in a September 25 change log, according to the report.⁶

That incident underscores why operating-system vendors are likely to tighten local agent privileges even when developers act in good faith. Agent apps are valuable targets because users may grant them durable access to personal and corporate context. A compromise of the agent can become a compromise of whatever the agent can reach.

This dynamic changes the threat model for desktop software. The old question was whether an app should be trusted. The agent-era question is whether the operating system can constrain and observe a trusted app after it has been granted a powerful role.

The platform trade-off: safety versus capability

Apple’s challenge is that Full Disk Access is not inherently illegitimate. Backup tools, disk utilities, endpoint security products, developer tools and accessibility software may require broad local privileges to function. MacRumors noted that Apple has not yet said when the new controls will be implemented, leaving open the practical question of how the company will avoid breaking legitimate workflows.⁴

The risk for platform vendors is overcorrection. If controls are too blunt, they may impair power-user workflows and enterprise management tools. If they are too permissive, agentic apps will continue to stretch legacy permissions into broad surveillance and automation channels.

A likely middle path is differentiated treatment for classes of software. Backup software, endpoint tools and AI agents may all request broad access, but the operating system can require different disclosures, entitlements, review processes, runtime indicators or management policies depending on the declared purpose and observed behavior.

Apple’s statement that AI agents make the risks grow “substantially” suggests the company sees autonomy as a meaningful design factor, not just another app category.¹ That is an important precedent for other desktop platforms.

What security and platform leaders should prepare for

Apple’s move should be read as a signal that broad local permissions are likely to become more regulated by the platform layer. Engineering leaders building agentic desktop apps should expect more explicit consent flows, stronger review of why local data is needed, and potentially more friction around persistent access.

Enterprise security teams should inventory which desktop applications have broad local privileges, including Full Disk Access on macOS, and identify which of those applications are AI-enabled or connected to external model services. They should also review whether current endpoint telemetry can show when an agent reads message stores, mail databases, browser profiles, cookies or local document repositories.

Product teams building agents should assume that “ask for everything once” will become a weaker and riskier design pattern. More sustainable architectures will minimize local reads, request access at the moment of need, explain the purpose in plain language, keep sensitive processing local when possible, and provide logs or user-facing histories of agent actions.

The wider platform lesson is that AI agents turn desktop permissions into active security boundaries. Apple’s Full Disk Access change is early evidence that operating-system vendors will increasingly decide how much autonomy third-party agents can exercise over a user’s local digital life.

That will reshape both app design and enterprise controls. The most successful agent platforms will not be the ones that obtain the broadest permission fastest. They will be the ones that make access constrained, explainable and auditable enough for users and administrators to trust.