Image: Apple Developer
Why it mattersA team shipping a macOS AI agent needs to design the product around narrower permissions now, because the single approval that lets an agent read every file on a Mac is going to require more explicit user action.
A Mac AI agent that reads your mail usually got there through one permission screen, granted once and remembered forever. Apple has announced it is going to make that path harder.
The company published a short developer post on 2 October 2026 titled "Updates to Full Disk Access in macOS", saying it will introduce additional controls around the setting and giving AI agents as the reason the risk has grown. No macOS version, no entitlement name and no date were given. The post is a signal of what Apple plans to tighten in a later release.
What the post says
Full Disk Access on macOS lets an application read every file on the system, including mail, messages and browsing history. Apple writes that the setting "largely sidesteps" the per app privacy controls built into the operating system, and that this exception was kept available so backup apps can function.
The statement is that going forward, Apple "will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action". The post gives the reason in one sentence: "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially." For a communication app, Apple adds, this access can also compromise the privacy of the people a user is messaging.
The incidents behind it
Sarah Perez at TechCrunch, reporting the same day, places the announcement next to two recent cases. Meta's Muse agent was reported to have reached a user's private messages without the user understanding the permission being granted. A flaw in the ChatGPT macOS app, patched on 25 September, let a local attacker read a user's chat logs with the model. Both involved an application running on the Mac with permission to read material a user did not expect it to touch.
The "grant once and forget" pattern is what has to change
A team shipping an AI assistant on macOS prepares now for a world in which Full Disk Access is harder to request, more visible to the user when it is granted, and more likely to be revoked by a later update. The practical move is to design the product so the agent does not need Full Disk Access in the first place, by asking for narrower permissions scoped to the folder or the file the user is working on, or by prompting the user at the moment the agent needs to read a given file.
Several current Mac agents rely on a permission a user grants once and never revisits. Apple's post signals the end of that approach, with the timeline deliberately left open so the company can tighten the setting across more than one macOS release.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
