Apple said Friday that macOS Full Disk Access can put files, mail, messages and browsing history within an app’s reach. It announced additional controls for granting that permission, but did not say whether they will limit what an app can access once it has it.
AI agents should receive access matched to the user’s task, not an invitation to browse far beyond it. A more emphatic yes-or-no prompt for Full Disk Access would not, by itself, solve the problem Apple has identified.
The permission is wider than many tasks
Full Disk Access has a legitimate purpose. Apple says it lets backup software work by largely bypassing macOS privacy controls. That breadth is precisely why the company warned Friday that granting it to an AI agent can affect not only the user’s privacy but also that of people who communicate with the user.
That warning describes possible exposure, not proof that every agent granted the permission reads messages or misuses data. Nor does it mean apps receive Full Disk Access automatically. Apple’s platform-security guide says apps needing access to the full storage device must be explicitly added in macOS settings.
The question is what happens after a user makes that choice. If a task calls for work on selected files, why should permission to do it also put mail and conversations within the app’s potential reach? A user can approve a request and still be given a choice that is much broader than the job at hand.
Apple plans to require very explicit user action before granting Full Disk Access. It has not described the new controls or given a release date. More deliberate consent would help users notice the decision. It would not necessarily give them a narrower one.
The Muse dispute does not settle the risk
The warning arrived after a dispute over Meta’s Muse agent. In a Sept. 19 account for Inc., columnist Jason Aten said Muse suggested a column based on a private Messages conversation and that he found evidence of a sync from his Messages database. He said he had declined Messages access and found Full Disk Access turned off.
Meta disputes that account of the permissions. Communications chief Andy Stone said Muse’s Messages integration requires both Full Disk Access and its Messages connector, according to Decrypt. Meta Superintelligence Labs executive David Singleton also said Muse’s explanation that it had seen notification banners was wrong; he said a bug could not bypass macOS protections.
Aten’s report is an account of his device, not an independent verification of its permission state when the sync occurred. Meta’s description of how its integration is supposed to work does not independently establish what happened on that device, either. The public accounts do not resolve whether access occurred without the required permissions. This case should not be presented as a proven macOS bypass.
But the case for narrower permissions does not depend on proving a bypass. Even if an agent obtains Full Disk Access with the required approval, Apple says the permission can expose substantially more information than one task may need. An opt-in connection to Messages may define a feature; it does not, on its own, narrow the underlying whole-disk grant to the app.
Free newsletter
Get the morning briefing
Start each day with the AI stories that matter and why — a short, free email from our newsroom.
An April 2026 research preprint offers broader context, not a verdict on Muse. Its authors say they analyzed 290 public reports of filesystem misuse across 13 agent frameworks and propose putting more controls at the filesystem level. Those reports are not a measure of how often agents misuse access, and the preprint does not verify Aten’s account. It does identify the practical tension: unrestricted access creates risk, while constant permission prompts burden users.
Convenience deserves a better answer than blanket access
The strongest argument for broad access is useful work without interruption. Backup software may need to reach across a device. An agent handling changing requests could become frustrating if it must stop for approval at every step. A permission system that turns routine work into a sequence of prompts risks teaching users to approve them without reading.
That is a reason to design better scopes, not to treat Full Disk Access as the normal answer for agents. A backup job has a defined need for breadth. An open-ended agent can move between tasks, and permission appropriate for one task need not be appropriate for the next. The user should be able to choose the files, data categories or app connection needed for the work, approve an expansion when the work changes and withdraw it afterward.
That is a proposal, not a feature Apple has promised. The company should say whether its planned controls will offer narrower grants, explain requested access in terms users can recognize and make revocation straightforward. Agent developers, for their part, should request access for a stated purpose rather than making a whole-disk grant the convenient route to unrelated tasks.
There will still be cases where broad access is justified. Users should be able to grant it knowingly when the function requires it. But Apple controls the permission model, and it should give users a meaningful option between refusing an agent’s task and exposing far more of their system than that task requires.