Apple said Friday it plans additional controls for macOS Full Disk Access, warning that AI agents granted the permission could expose files, mail, messages and browsing history. The warning describes a potential risk. Apple did not publish a test showing that agents generally read or disclose that data.
Full Disk Access is a broad permission a Mac user grants to an app in System Settings. Apple has not said when the new controls will arrive or what users will have to do differently, leaving the practical effect of its announcement unclear.
What the permission gives an app
Apple says it created Full Disk Access for jobs such as backing up a Mac, which may require software to reach files throughout the system. The permission largely bypasses privacy restrictions that would otherwise limit an app’s access to data.
That breadth is why Apple is concerned about agent apps. A user might grant access to get a particular task done, but the permission can put more information within the app’s reach than that task appears to require. Apple lists files, mail, messages and browsing history among the data at issue.
Access and disclosure are different. Granting the permission can make information available to an app; it does not establish that the app reads every file it can reach, shares anything with its developer or sends data elsewhere. Those would be claims about what a particular app does, requiring evidence about that app.
The potential exposure also reaches beyond the person who owns the Mac. Mail and messages can contain communications from other people, whose information may become accessible when the user grants an app broad access. Apple says their privacy could be affected, too.
What evidence supports Apple’s warning
Apple said, as reported by Engadget: “Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding”. That is Apple’s assessment of the risk, not a finding from an independent test published with its announcement.
The company says the risk could grow as agents become more capable and autonomous. Its statement does not identify a tested agent, document a specific incident or measure how often apps use the permission to reach sensitive data. The independent reporting reviewed does not verify that broader prediction with a technical test.
Apple’s description of what Full Disk Access permits helps explain how an app could encounter private information. It does not establish whether an agent has used that access to disclose it. Nor does the warning show that every agent requests Full Disk Access or that every app with the permission uses all the access it receives.
That distinction matters when assessing the announcement. The breadth of the permission is a reason to scrutinize an app’s request. It is not, by itself, evidence that a specific developer has read or transferred a user’s files.
Free newsletter
Get the morning briefing
Start each day with the AI stories that matter and why — a short, free email from our newsroom.
What Apple has promised to change
Apple says its planned controls will require explicit user action. Users already have to choose to grant an app Full Disk Access in System Settings, so that description does not yet explain what additional decision or safeguard Apple intends to introduce.
The company has not specified a rollout date, which macOS versions or apps the controls would cover, or whether they would change permissions users have already granted. It has announced a response, not released a new protection that Mac users can assess.
For now, the decision a user faces is whether an app’s purpose justifies giving it broad access to information on the Mac, including communications involving others. Apple’s next details will need to show what its new controls add to that existing choice.