Apple Says It Will Tighten Full Disk Access Controls on macOS

TL;DR

• On October 2, 2026, Apple said it will add new controls to a Mac setting called Full Disk Access, which currently lets an approved app read almost everything on a computer — files, mail, messages and browsing history — in one step.
• Apple says some developers are using that access in ways users don’t fully understand, and that AI agents becoming more capable and independent will make the risk bigger.
• The announcement follows two separate incidents involving AI programs on the Mac: a disputed claim that Meta’s Muse assistant read a journalist’s private messages, and a security flaw in OpenAI’s ChatGPT Mac app that has since been fixed.
• Apple has not said how the new controls will work or when they will arrive, and it has not named either incident as the reason for the change.

What happened

Apple published a developer-news post on October 2, 2026 announcing changes to Full Disk Access, a macOS permission that, once granted, lets an app read nearly everything stored on a Mac. The feature was originally built so backup software could copy an entire filesystem in one step instead of asking for permission folder by folder, according to background included in Apple’s own framing of the permission.

Apple’s post says some developers are exploiting that broad access: “Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding,” the company wrote. Apple also said this can expose the privacy of people the user communicates with, not just the user themselves, according to the same post.

The company tied the change directly to AI agents — software that can act on a user’s behalf with increasing independence: “As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially,” Apple said. Its stated fix is procedural rather than technical: “Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action,” the company said. TechCrunch reported the announcement the same day and said Apple did not respond to its request for further comment on how the controls would work. Engadget independently reported and confirmed the same statement, framing it against scrutiny of desktop AI agents including Meta’s Muse and OpenAI’s ChatGPT app.

The announcement arrived in the wake of two incidents in the preceding two weeks. Inc. columnist Jason Aten reported that Meta’s Muse AI agent synced roughly 187,000 lines from his Mac Messages database even though he says he had declined to grant Muse access to Messages and had kept Full Disk Access turned off. Meta disputed this. Vice President of Communications Andy Stone said that “the Messages integration in the Muse app for Mac is entirely opt-in” and that “you have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content. It can’t read your Messages unless you do this.” Meta Superintelligence Labs executive David Singleton added that reading Messages requires “three separate steps of application-level permissions and built-in macOS system-level protections” that, he said, “can’t be circumvented even if the Muse application had a bug,” according to the same TechCrunch report.

Separately, security researchers at the Objective-See Foundation found a vulnerability in OpenAI’s ChatGPT Mac app, cataloged as CVE-2026-100754, that let unprivileged local code impersonate trusted app components by exploiting a flawed process-signature check. OpenAI patched it on September 25, 2026 in app version 26.924.20706, according to the same report.

What this means (and what it does not)

Apple’s statement establishes that the company plans to make it harder to grant Full Disk Access by accident or without understanding what is being shared, and that it is doing so because it expects AI agents to make the permission riskier over time. That is as far as the confirmed facts go.

It does not establish what the new controls will actually look like. Apple’s post describes a goal — “very explicit user action” — not a mechanism. It is also not established that either the Muse dispute or the ChatGPT Mac app vulnerability specifically triggered the change: Apple’s post refers only to “AI agents” and unnamed “developers” in general terms, without naming either incident.

The framing benefits different parties in different ways. Apple can point to the move as proactively closing a privacy gap at a moment when AI agents on rival platforms are drawing scrutiny. Meta has a strong incentive to keep disputing the Muse claim, since broad data access underpins the product Muse is built to be, and a confirmed violation would invite exactly the kind of restriction Apple is now describing. OpenAI benefits from its vulnerability being seen as quickly found and patched. Microsoft, which said in an October 16, 2025 blog post that it would give AI agents on Windows separate, restricted accounts limited by default to folders such as Documents and Downloads, benefits from appearing to have addressed this category of risk roughly a year earlier.

What we still do not know

Apple’s post names no concrete technical mechanism — no description of new confirmation dialogs, changes to the underlying permission system, time-limited or revocable grants, or restrictions scoped to individual agents — and no source reviewed reports a rollout timeline beyond “going forward.” It is also unclear whether Apple intends to restructure the broader permission framework the feature sits inside, or simply add friction in front of the same all-or-nothing grant, and whether the change will affect legitimate automated tools such as backup software, accessibility tools or IT management agents — the category Full Disk Access was originally built to serve.

The underlying dispute between Jason Aten and Meta also remains unresolved. Meta says Messages access cannot occur without both Full Disk Access and an in-app connector being separately enabled by the user; Aten says Full Disk Access was off on his machine. No independent technical audit of either account has been reported. Readers should treat Apple’s stated rationale, Meta’s rebuttal and OpenAI’s patch timeline as claims from the parties involved rather than as independently verified facts, since no outside review of any of them was found.