Apple to Restrict macOS Full Disk Access for AI Agents

Apple plans to overhaul how macOS handles Full Disk Access permissions, targeting a wave of artificial intelligence desktop agents that require sweeping system privileges to function. The change will force users to take deliberate, explicit steps before granting any application the ability to read across an entire Mac hard drive.

The Cupertino company did not provide a release timeline or detail the specific interface changes coming to System Settings. However, the policy shift directly addresses a growing class of autonomous software—including OpenClaw, Dots, and Meta’s Muse—that relies on deep file-system access to execute complex tasks like organizing documents, summarizing emails, and managing local workflows.

Full Disk Access has existed in macOS since the 2018 release of Mojave, when Apple introduced it as a privacy safeguard under its Transparency, Consent, and Control framework. Originally designed to prevent malware from scraping sensitive directories, the permission bypasses standard app sandboxing to expose everything stored locally: iMessage databases, Mail archives, Safari history, and third-party application data. For years, only specialized utilities such as backup software, antivirus tools, and terminal emulators required this level of clearance. The rise of local AI agents has fundamentally changed that dynamic, transforming a niche administrative setting into a mainstream consumer prompt.

Apple warned that some developers are leveraging this access in ways that compromise user privacy without adequate disclosure. Because these agents process unencrypted local data to generate responses or complete actions, they expose not only the account holder’s information but also the private communications of anyone who has corresponded with them via text or email.

The security risks have already altered consumer hardware purchasing patterns. Rather than exposing their primary workstations to autonomous agents, many developers and early adopters have begun buying secondary machines dedicated solely to running AI software. This practice contributed to widespread inventory shortages of the Mac Mini throughout the year, as users sought affordable, isolated environments for experimental tools.

Concerns over unintended data exposure intensified recently following the rollout of Meta’s Muse agent. Users reported that the application interacted with personal messages despite apparent attempts to restrict those permissions. Tech columnist Jason Aten documented an instance where the Muse Mac client accessed his message history after he believed he had denied the request. Meta maintained that message synchronization required an affirmative opt-in from the user, underscoring the confusion surrounding how these applications present and enforce consent.

Unlike traditional mobile apps governed by granular permission toggles—where a user can grant access to a camera while denying contact lists—desktop AI agents generally demand binary, all-or-nothing access to be useful. This architectural reality clashes with modern operating system security models designed around least-privilege principles. By promising additional friction before Full Disk Access is granted, Apple is signaling a broader industry reckoning over how operating systems mediate trust between humans and autonomous software.

Apple stated it remains committed to ensuring users understand the privacy tradeoffs involved before enabling such capabilities, framing the upcoming controls as a necessary response to increasingly autonomous AI behavior.