AI news ·
Apple tightens macOS full disk access controls to limit AI agent misuse
Apple will tighten macOS Full Disk Access controls to stop AI agents from exposing user data without clear consent, requiring "very explicit user action" before granting permission.
Apple announced on October 2, 2026 that it will tighten controls around macOS Full Disk Access to address risks from AI agents. The company said some developers use the permission in ways that can expose user data without clear consent, and the change will require "very explicit user action" before access is granted. No specific macOS version or release date has been provided.
The Meta Muse AI incident
Coverage of Apple's announcement diverges on whether to include a recent incident involving Meta's Muse AI. Ars Technica and The Verge both reference a report that columnist Jason Aten discovered Muse had accessed his Messages without permission. The Verge frames it as a prior report by TechCrunch, while Unite.ai does not mention the incident at all.
What the new controls will require
Apple has not detailed the exact mechanism, but the company emphasized that users will only be able to grant Full Disk Access through a deliberate, unambiguous step. The goal is to prevent AI agents or other applications from obtaining broad file system permissions without a user fully understanding what they are approving.
Full Disk Access is a macOS security feature that allows applications to read and write files across the entire system, including sensitive locations like Messages, Mail, and Time Machine backups. Once granted, the permission is persistent unless manually revoked in System Settings.
Why this matters for legal, HR, and management professionals
Organizations that deploy AI agents on employee Macs face direct exposure to data leakage risks through overly permissive file access. Legal and compliance teams should audit which applications currently hold Full Disk Access and prepare internal policies that align with Apple's coming enforcement model. For HR and PR leaders, the Muse incident demonstrates how quickly an AI tool's data access can become a reputational problem when employees' private messages are involved.
Professionals responsible for IT governance can explore AI Security Analytics Courses to build internal capability around agent risk assessment. For CIOs and senior IT leaders shaping procurement standards, AI IT Strategy Training offers guidance on evaluating third-party AI tools before they reach employee devices.