On October 2, 2026, Apple published a brief statement on its developer news site that tied a foundational privacy primitive - Full Disk Access on the Mac - to the risk profile of AI agents. Full Disk Access is the permission that lets an app read files, mail, messages, and browsing history on a Mac. Apple announced it would “introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action,” and justified the change by writing that “as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.”
Apple did not say what prompted the change, but it came about two weeks after, by Ars Technica’s count, the start of a public dispute in which an Inc. columnist reported that Meta’s Muse knew the contents of his messages even though, by his account, he had not given it permission. Meta disputed his account.
What Apple said, and what it did not say
Apple’s developer news post is short on technical detail and pointed in framing. It notes that Full Disk Access “largely sidesteps” the per-resource privacy controls the rest of macOS relies on, and that it does so “to allow backup apps to function properly” on the Mac. The company argues that “some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems - including files, mail, messages, and even browsing history - without users’ full knowledge and understanding,” and that for communication apps, the misuse “can also compromise the privacy of the people users are communicating with.”
The post never names Meta, Muse, ChatGPT, or any other vendor, and does not say when the new controls ship, what platform version they will land in, or whether existing FDA grants will be revoked. Apple did not respond to requests for comment from The Verge or TechCrunch at publication. What is concrete is the framing: the change is justified by AI agents becoming “increasingly capable and autonomous,” not by a generic privacy tune-up.
The Muse incident and the question it left open
The proximate event was a report by Inc.’s Jason Aten that Meta’s Muse knew the contents of his private messages even though, he said, he had not given the agent permission to access them. Meta spokesperson Andy Stone pushed back, saying access to Messages is “entirely opt-in” and that users have to “enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content.” Meta CTO David Singleton made the same case: “The Messages integration in the Muse Mac app is opt in. Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled.”
Ars Technica’s Dan Goodin then spoke to macOS security researcher Patrick Wardle, who questioned Singleton’s denial: “From a technical point of view, with FDA (full-disk access), any (non-root file), is readable, browsing history, browser cookies, chats, etc etc etc.” When Goodin asked Meta how Muse could not read messages when the app had full disk access, Meta’s only response, per Goodin, was to requote Singleton.
That exchange is what made Apple’s October 2 statement matter. Apple did not name Muse, but Ars Technica judged the timing, on the heels of a social media uproar, made a link likely. Apple is now on the record that apps granted FDA can expose files, mail, messages and browsing history, which, as Ars noted, seems to contradict Meta’s denial.
Agents are an attractive target, not just an attractive tool
The Muse incident is the visible story; the structural problem is older. AI assistants that act on a user’s behalf need sweeping access - mail, messages, browsers, forms - and that surface area makes them high-value targets in enterprise incident reports. Wired’s coverage of a recently patched ChatGPT macOS vulnerability, published the same day as Apple’s statement, makes the point concrete. Researchers at the Objective-See Foundation found the ChatGPT macOS app contained a trusted script interpreter that would accept an untrusted script, which could then be passed into the main ChatGPT process. The flaw could only be exploited by an attacker who already had malware on the machine, but it was “insanely trivial” to exploit, in Wardle’s words, and his proof of concept needed only about a dozen lines of code. Once inside, the flaw could expose chat logs and steer ChatGPT into running commands for the attacker, such as accessing a browser or other sensitive applications, with the requests appearing as legitimate instructions from the OpenAI software.
Wardle, who will present more AI macOS bug analysis at the Objective by the Sea conference in November, told Wired: “Agents need a lot of access to do their job. They are like the building manager who has access to the keys to all the rooms. So if they can be corrupted or subverted, that’s super problematic.” His second line reads as a warning to the whole sector: “AI companies are fixated on adding features right now. But as always, the more features, the broader the attack surface. So all of these companies need to be fully focused on security, and from what I can see, it still often seems like an afterthought.”
Apple’s statement names neither the Muse dispute nor the ChatGPT flaw, but TechCrunch noted that the decision came after both. Apple’s move suggests desktop operating systems may start treating AI agents the way browsers treated plug-ins - with more friction and less default access to the rest of the system.
What This Means
For now, the practical change is small. Existing FDA grants on macOS still work. Apple has not said what form the “very explicit user action” will take or when it ships; TechCrunch characterized the change as informed consent rather than a new limit. The bigger change is precedent: a major OS vendor has publicly named AI agents as a reason to add friction to its most powerful permission.
The same FDA toggle that lets an agent read your email lets it read your messages, your browser history, and any file your user account can see. Until Apple’s new controls land, every Mac user with an agent installed has the same decision to make: keep FDA on and accept that the agent - and any process that can compromise it - can read the same surfaces, or turn FDA off and accept that the agent cannot do the work it was installed for.
For agent vendors, the writing is on the wall in both Apple’s statement and Wardle’s research. Agents that need FDA to function will face new friction every time a user tries to grant it, and bugs in those agents will land on a more visible stage.
The Bottom Line
Apple has said it will add friction to a core macOS privacy permission, citing AI agents, weeks after a public dispute over what Meta’s Muse could read. Until the new FDA flow ships, every Mac user with an AI agent installed should treat the FDA toggle as the most consequential permission on the machine, and turn it off when they do not need it.