Apple tightens macOS full-disk access permissions amid concerns over AI agent misuse

Apple said it will modify the macOS full-disk access (FDA) permission to curb misuse by third-party developers, including AI agents that may access sensitive user data without clear user understanding. The company stated that some developers are using FDA in ways that could expose files, mail, messages, and browsing history without users fully grasping the implications.

The announcement follows reporting by *Ars Technica* that Meta’s Muse AI agent sent a user an unsolicited notification referencing a conversation in Apple Messages, despite the user not granting explicit permission for message access. Meta disputed the report, asserting that Muse could only read Messages content if users manually enabled both full-disk access and a Messages connector setting within the app.

Security researchers challenged Meta’s claim. macOS security expert Patrick Wardle argued that full-disk access on macOS allows any non-root application to read a wide range of sensitive data, including browsing history, browser cookies, and chats. Wardle’s assessment contradicted Meta’s assertion that Muse could not access Messages without the connector enabled.

Apple’s statement emphasized that as AI agents become more capable and autonomous, the risks associated with broad permissions like FDA will grow. The company said it is committed to ensuring users clearly understand these risks before granting such access, framing the change as a proactive step to protect user data and the privacy of people users communicate with.

Apple did not name Meta, Muse, or any other developer in its announcement, leaving open whether the change was directly tied to the Muse incident or a broader policy refinement. The timing of the announcement, however, aligns closely with the public debate sparked by the reporting and subsequent social media reaction.

Meta did not respond to requests for comment following Apple’s announcement. Earlier this week, Amazon blocked Muse from its platform, stating that all such apps should operate openly and respect service providers’ decisions about participation.