Apple is moving to tighten the macOS setting called Full Disk Access, in a direct response to the security and privacy risks created by AI agents that read mail, messages, and other sensitive files on a user’s machine. The change means that broad FDA grants, which today can quietly expose almost every file on a Mac, will require a more explicit user action before an app can use that access in the background.<\/p>\n
Full Disk Access, accessed under Privacy and Security in the macOS Settings app, was introduced in macOS Mojave (version 10.14). Once an app is granted FDA, it can bypass parts of Apple’s app sandbox and read or write to system files that are normally off-limits to ordinary programs.<\/p>\n
The setting is needed for legitimate tools, including security software and backup utilities, that require deep system access. Apple’s concern is that the same level of access is now being requested by AI agents that users do not always understand. In a post on the topic, the company said some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems including files, mail, messages, and even browsing history without users’ full knowledge and understanding. The post added that for communication apps, this can also compromise the privacy of the people users are communicating with.<\/p>\n
Apple has tied the change to AI agents, which can act autonomously in ways traditional security and backup tools do not, and is committing to making sure users grasp those risks before granting Full Disk Access so they can make informed decisions about their data.<\/p>\n
The trigger for the announcement was a public report in which an agentic tool is said to have read a journalist’s private iMessages after being given Full Disk Access. Meta’s Muse product, advertised as a personal AI agent built along the lines of OpenClaw and run on a dedicated Linux virtual machine in Meta’s cloud, was the tool at the center of that report. Meta has since clarified that for Muse to read Messages content, the macOS Full Disk Access permission must be granted and a Messages connector inside Muse must also be enabled, and the integration is opt-in.<\/p>\n
Apple did not name any specific product in its announcement, but the timing lines up with that report and with a separate proof-of-concept exploit that targeted a flaw in the Muse Mac app.<\/p>\n
Security research released before Apple’s post demonstrated a proof-of-concept exploit for a zero-day in the Muse Mac app, referred to as not-a-mused. The flaw allowed any app or terminal command on the same machine to obtain the token that authenticates a user to their Muse account, without special privileges.<\/p>\n
The now-patched vulnerability could let an unprivileged local process redirect Muse’s dictation traffic and abuse the trust and access granted to the app. Because Muse already holds a high level of access on the Mac, that token theft gave an attacker a much wider foothold than ordinary local malware would have, a useful target for privilege and access amplification.<\/p>\n
The PoC exploited an undocumented setting named “endo_voyager_dictation_endpoint” that did not require administrative privileges. Once triggered, it could capture dictated audio and prompts, inject malicious prompts, and abuse the broader access Muse had been granted for further malicious actions.<\/p>\n
The same researcher was also acknowledged for reporting a second issue, tracked as CVE-2026-100754, affecting OpenAI’s ChatGPT app for Mac. That bug could have been used to take over the AI assistant and reach chat logs and other data the app stored locally.<\/p>\n
Taken together, the Muse case, the ChatGPT Mac issue, and Apple’s own warning describe a wider pattern. Agentic tools tend to sit in a privileged position on the operating system, collect large amounts of data, and interact with many parts of the system at once: writing files to disk, using the microphone and camera, creating calendar events, sending email, and reading location. Each of those is a surface an attacker can pivot through if the agent’s process is compromised.<\/p>\n
Apple’s response is to make the entry point to that privilege, the Full Disk Access toggle, harder to grant casually. The plan is to update the setting so that this sort of access is given only with an explicit user action. Apple has not said when the new controls will be rolled out.<\/p>\n
Until the new macOS controls ship, Full Disk Access is the single switch that decides whether an AI agent on the Mac can see Mail, Messages, Safari, Time Machine backups, and the rest of the system. Reviewing which apps are currently listed there, and removing any that are not in active use, removes a layer of standing access. For users who do want a particular AI tool to read certain files, granting FDA only for the duration of a specific task, then revoking it, shrinks the window in which a token-stealing bug or a malicious update could pull data from the Mac.<\/p>\n
Full Disk Access is a macOS privacy setting, introduced in macOS Mojave (10.14) and found under Settings, Privacy and Security, that lets an app bypass parts of Apple’s app sandbox so it can read and write to system files normally off-limits to programs. It is needed for backup and security tools, but it also exposes Mail, Messages, Safari data, and Time Machine backups to any app that is granted the permission.<\/p>\n
Apple says some developers are using Full Disk Access in ways that could put users at risk, exposing files, mail, messages, and browsing history without users’ full knowledge and understanding, and that as AI agents become more capable and autonomous the risks will grow. The change is meant to make sure broad access is granted only with an explicit user action.<\/p>\n
A report described a case in which the Muse personal AI agent accessed a journalist’s private iMessages after it was granted Full Disk Access. Meta has said the Messages integration in the Muse Mac app is opt-in and that a user’s Muse can only read Messages content if macOS Full Disk Access is granted and the Messages connector inside Muse is also enabled.<\/p>\n