Apple tightens Mac full disk access permissions

The announcement didn't come out of nowhere - it followed a specific, contested incident. Inc. columnist Jason Aten reported that Meta's Muse agent appeared to have synced his Messages database up to row 187,462 despite Full Disk Access being switched off on his device, and that Muse surfaced a notification referencing a private conversation ^[1]. Meta's communications chief Andy Stone pushed back directly, saying Muse can only read Messages on a Mac if a user enables two separate settings - macOS Full Disk Access plus an in-app Messages connector - and that both must be deliberately turned on ^[2]. Neither side's technical account has been independently verified in the research gathered here, but the dispute itself is the point: even a sophisticated user and a well-resourced company can't agree on what permission was actually granted, which is precisely the ambiguity Apple's new 'very explicit user action' requirement is designed to close.

Full Disk Access wasn't built with AI in mind - it exists because Apple needed an all-or-nothing bypass so backup software could read the entire disk without constant prompts. When macOS Catalina expanded protected folders in 2019, Full Disk Access became the blanket override for all of them at once ^[3]. That history matters now because, as security analysts quoted in trade coverage note, AI agents don't behave like the backup tools the permission was designed for - they can dynamically explore a file system, connect disparate data points, and infer information from sources a user never explicitly shared, a pattern described as 'permission creep' ^[4]. A control built for a narrow, predictable use case is now the single biggest exposure point for an unpredictable, autonomous one, which is exactly what Apple cites as the reason for acting now ^[5].

Reaction on X skewed toward straightforward tech-press reporting of the facts, but one notable voice broke from that pattern - Federico Viticci flagged the plan as 'concerning' for developers, framing it less as a consumer privacy win and more as a new control surface that Mac developers will have to design around. That split mirrors what trade coverage describes more broadly: some companies reportedly welcome the added clarity Apple is giving users, while others worry that stricter, more deliberate consent gates could slow AI feature development on the Mac ^[4]. Apple itself has stayed silent on the mechanics - it has not said when the new controls ship or exactly what the extra friction will look like ^[7]- which is part of why developers who rely on Full Disk Access are reacting to an unknown rather than a finished policy ^[6].

Not every reaction treats 'more explicit user action' as a solution. A recurring critique in community discussion is that permission dialogs are a weak defense against determined overreach, because users eventually click through warnings reflexively - a dynamic sometimes called prompt or consent fatigue - and that durable protection requires OS-level sandboxing or isolation (separate user accounts, containerized environments) rather than a bigger confirmation screen. That skepticism exists alongside direct evidence of the underlying risk Apple is responding to: at least one user has publicly described deliberately handing an AI agent access to banking, health, smart-home, and full cloud-storage data, which is close to the worst-case scenario Apple's own language warns about - an app exposing 'everything on their systems' without a user fully grasping what they agreed to ^[5]. The tension is that the same permission model can be both the problem (too easy to grant broadly) and, in friction-fatigue critics' view, an insufficient fix (too easy to click through once it's offered).