Full Disk Access was built to let backup software work properly. AI agents are turning that permission into something much more consequential.
Apple is preparing new controls around one of the most powerful permissions available on a Mac after acknowledging that AI agents have changed the risk attached to it. Full Disk Access can give an application access to files, email, messages and browsing history, effectively allowing software to reach across large parts of a user’s digital life. Apple says some developers are now using that permission in ways users may not fully understand.
The setting itself is not new. Apple originally designed Full Disk Access so applications such as backup software could function without repeatedly requesting permission to individual folders or categories of data. What has changed is the software asking for that access. Traditional backup utilities primarily copy information. AI agents are increasingly designed to read information, interpret it and take actions based on what they find. Meta’s Muse, for example, can interact with files, messages, calendars, notes and mail through its Mac application.
A permission designed for one era is being used in another
Apple’s own language makes the shift unusually explicit. The company said Friday that Full Disk Access can expose “everything” on a system and warned that the problem will grow as AI agents become more capable and autonomous. Apple plans to introduce additional controls so granting that level of access requires what it described as “very explicit user action.” The company has not yet detailed exactly what the new interface or approval process will look like.
The announcement follows a dispute involving Meta’s Muse. Inc. columnist Jason Aten said the AI agent appeared to know information contained in his private messages despite his belief that he had not authorized that access. Meta disputed that account and said Muse cannot access Messages without explicit permission. The disagreement exposed a problem extending beyond any single application: once an AI agent receives broad system access, users may have difficulty understanding which information the agent can retrieve, when it can retrieve it and how that information influences subsequent actions.
Security researchers have simultaneously been finding vulnerabilities in increasingly capable desktop AI applications. WIRED reported this week that researchers discovered and helped patch a flaw in the ChatGPT Mac application that could have allowed attackers to execute commands through the application and potentially access sensitive information, including chat logs and browser sessions. The vulnerability involved compromising software that users had already trusted, rather than persuading them to install obviously malicious software.
AI changes what permission means
For years, computer security has largely treated permissions as a binary choice: an application either receives access or it does not. Agents complicate that model because the software is increasingly capable of making decisions after permission has been granted. An application that can read email, search documents, examine browsing history and interact with other programs is not simply accessing information. It can assemble context across those sources and potentially act on it.
That creates a second privacy issue Apple specifically highlighted. Full Disk Access does not expose only the person who granted permission. An AI application capable of reading email or messages can also process information written by friends, coworkers, clients and other people who never consented to interacting with the agent at all. Apple warned developers that communication applications using Full Disk Access can therefore compromise the privacy of people with whom the Mac owner communicates.
Apple’s response is still primarily about informed consent rather than prohibiting the permission. Users will apparently remain able to grant AI applications broad access if they choose. But requiring a more deliberate approval process signals something significant about where personal computing is heading. The next generation of privacy controls may have to distinguish between software that needs access to perform a narrowly defined task and software capable of observing, reasoning and acting across the computer once that door has been opened.
Full Disk Access used to sound like a technical setting buried inside System Settings. With autonomous AI moving onto the desktop, it is becoming a much bigger question: how much of your computer should one application be allowed to understand?