Apple strengthens full‑disk access control on macOS amid AI agent risks

Apple announcement and context

On October 2 2026, Apple presented during a developer session a series of additional controls surrounding the permission known as Full Disk Access (FDA) on macOS. The company did not disclose a precise rollout date, but it indicated that the new requirements will be baked into future releases of the operating system. Historically, this permission has been reserved for backup and security utilities, and it enables an application to read the entire contents of the user’s disk, including email messages, iMessage conversations, web‑browser history, and other sensitive data, by bypassing the usual system‑level protections.

What is full‑disk access?

Full Disk Access is a system‑level authorization that grants an application the right to traverse every directory on the user’s disk, even those that are normally protected by macOS sandboxing mechanisms. In practical terms, an app that holds this permission can read Mail databases, Message archives, browser configuration files, and any other file stored locally on the machine. Apple originally introduced this permission to meet the needs of backup, encryption, and data‑recovery software, but it has also been repurposed by less transparent programs that seek broader visibility into user data.

Controversy surrounding Muse and unauthorized notifications

Apple’s announcement came after a controversy sparked by journalist Jason Aten, who received a notification from the Muse app that claimed to originate from an Apple Messages conversation he had never authorized. Aten asserted that the notification was generated from an analysis of his message history, raising questions about the legitimacy of the consent that had been given. Meta, the owner of Muse, responded by stating that access to Messages requires both Full Disk Access and the activation of the Messages connector, a dual condition that the company believes is sufficient to protect user privacy.

Security expert Patrick Wardle reminded observers that, from a technical standpoint, any application possessing Full Disk Access can read the files that contain messages, even if the Messages connector is not turned on. According to Wardle, the combination of these two requirements does not constitute an infallible barrier, especially when an artificial‑intelligence agent is capable of exploiting the accessible data to generate notifications or automated replies. This observation amplified concerns about the ability of AI agents to bypass traditional consent controls.

How the new consent mechanism will work

Apple indicated that the forthcoming mechanism will require a “highly explicit” consent from the user before Full Disk Access is granted to any application. Concretely, the system will display a dialog box that details the specific types of data that will become accessible—such as email, messages, browsing history, and so on—and will ask the user to check each category individually that they agree to share. This approach is intended to prevent developers from hiding the true scope of access behind a generic label, while giving users greater visibility into the potential risks.

• The user must explicitly confirm each data type (email, messages, browsing history, etc.).
• The system will record the consent in the privacy settings, allowing review or revocation at any time.
• Applications must justify every access request in their documentation and in the dialog presented to the user.

Implications for developers and organizations

For developers, these new requirements mean that they will have to rethink how they request Full Disk Access. Generic requests will be rejected by the system, and teams will need to provide clear, detailed explanations in their product listings. Organizations that deploy backup or data‑management solutions on macOS will have to verify that their tools comply with the new consent rules, or risk having their applications blocked or their users confronted with frequent security alerts.

IT managers are encouraged to audit the current permissions granted to the software in use, to update internal access‑management policies, and to train users on the meaning of the new consent dialogs. In practice, this involves documenting precisely which types of data each application truly needs to read, disabling non‑essential functions, and monitoring consent logs for any signs of abuse.

In conclusion, the changes announced by Apple aim to make Full Disk Access more transparent and to reduce the risks associated with AI agents that could exploit these privileges. Although the company has not specified a deployment timetable, organizations in France and elsewhere will need to start preparing now to adapt their permission‑management processes, to revise supplier license agreements, and to inform their users about the new explicit‑consent requirements.