Apple tightens macOS Full Disk Access over AI agent risks

Full Disk Access was originally created largely as an exception for backup software, letting it work around macOS's normal privacy controls ^[6]. That history matters now because the permission is extremely broad by design: security researcher Patrick Wardle notes it grants read access to effectively any non-root file on a Mac, including Messages chat databases, browser cookies, and browsing history ^[2]. Apple's own language acknowledges the mismatch between that original purpose and how it is used today: "Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems - including files, mail, messages, and even browsing history - without users' full knowledge and understanding" ^[1]. The company frames this as a structural problem that will only get worse, warning that "as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially" ^[1].

The immediate trigger for Apple's announcement traces back to a single contested story. Columnist Jason Aten reported that after installing Meta's Muse on his iPhone and Mac mini, the agent referenced private Messages content - including a column idea drawn from a conversation with his podcast co-host - even though Full Disk Access appeared switched off in System Settings; he later found Muse had synced his Messages database up to row 187,462 ^[3][4]. Meta disputed the account directly. Communications chief Andy Stone said "It can't read your Messages unless you do this," and Meta Superintelligence Labs lead David Singleton stated that "the Messages integration in the Muse Mac App is opt-in" and requires three separate permission steps that cannot be bypassed by macOS system protections ^[3]. Neither account has been independently verified, leaving an unresolved contradiction between a concrete, specific claim and a detailed technical denial.

Distinct from the disputed Messages claim, Wardle's research describes a vulnerability that is independently demonstrated rather than contested. His proof-of-concept, published September 21, 2026, showed that an undocumented Muse Mac app preference called endo_voyager_dictation_endpoint could let malware already running as the logged-in user redirect dictation, read what a user dictates, inject trusted instructions, and capture authentication tokens, something he described as making it "trivial to turn Muse into the ultimate backdoor" ^[2]. Wardle is careful to scope the risk: the flaw "only works if an attacker can already run code as the logged-in user. It cannot break into a Mac on its own," though it could be chained with social-engineering tricks ^[2]. Apple's announcement arrives alongside a separately reported flaw in OpenAI's ChatGPT Mac app that could have let attackers reach sensitive data before OpenAI fixed it, suggesting the company is responding to a pattern across AI desktop agents rather than one isolated product ^[5].

Even with Apple's stricter gating on granting Full Disk Access, the permission's underlying scope does not change - it still hands out read access to virtually all non-root files on the system ^[2]. The unresolved question underneath both the Muse dispute and Apple's fix is the same one: whether a single permission toggle, however explicit, is still a meaningful control once an agent is capable, autonomous, and already running with the user's own system privileges.