Apple Tightens macOS Full Disk Access After AI Agents Quietly Siphon Messages and Files

Apple is clamping down on one of the most powerful switches in macOS. The company says it will add new controls around Full Disk Access, the permission that lets an app read essentially everything on a Mac, after a wave of AI desktop agents started using it to pull in files, Mail, Messages and browsing history, TechCrunch reports.

The problem is consent. Full Disk Access was built for backup tools and security software, things that genuinely need to see the whole drive. Now agents like OpenClaw, Dots and Meta's Muse ask for it so they can act on your behalf, and plenty of users click through without realizing what they just handed over.

That gap became painfully concrete for Inc. columnist Jason Aten, who found that Muse on his Mac seemed to know the contents of private messages he believed he had never shared with it. Meta's response was that he must have opted in if his Messages were syncing, Engadget notes. Around the same time, Wired reported that a flaw in a ChatGPT Mac app could have exposed sensitive data.

Apple's message to developers is blunt. Some apps, it said, use Full Disk Access in ways that expose everything on a system, and in the case of messaging apps that also compromises the privacy of the people users talk to. Your friends never agreed to let an AI agent read their texts, but a single checkbox on your machine can make that happen.

Going forward, Apple says anyone who truly wants to grant that extraordinary level of access will have to take very explicit action, according to 9to5Mac. This is about informed consent rather than a hard ban. Apple did not say when the change ships or what the new prompts will look like.

The move lands in a season of growing unease over always-on AI that watches more than people realize. California just saw Governor Newsom veto a bill aimed at secret recording by smart glasses, and state Attorney General Rob Bonta has subpoenaed OpenAI and Hugging Face over rogue AI agents. Apple, at least, has decided its own platform should not be where agents quietly help themselves to everything.