Apple Tightens Full-Disk Access Rules as AI Agents Test macOS Permissions

Apple has moved to restrict full-disk access permissions on macOS, a change aimed at limiting how much of a user's machine third-party software — including autonomous AI agents — can read and modify. The company confirmed the adjustment after scrutiny over whether existing safeguards were strong enough to prevent misuse, according to Ars Technica. The revision targets the broad entitlement that lets apps reach files across the entire drive rather than only user-approved locations.

Full-disk access has long been one of the most sensitive capabilities on macOS because it bypasses the per-folder consent prompts that normally govern file reads. Once granted, an application can quietly enumerate mail stores, message databases, browser profiles, and system logs without further user interaction. That property was tolerable when the permission was mostly used by backup utilities and security tools, but it becomes far more consequential when software can act on its own.

The change lands as AI agents that operate a user's computer directly — clicking, typing, and reading the screen — move from demos into shipping products. Those agents frequently request the same wide permissions that traditional utilities do, but their behavior is harder to predict because the model, not a fixed code path, decides which files to open. Apple's position is that the FDA-style review process some vendors have proposed is not a substitute for the operating system enforcing limits at the API level.

Meta has argued the opposite in recent commentary, contending that external review or regulatory oversight is insufficient on its own and that platform-level controls need to go further. Apple's response, in effect, is that it is already tightening the controls rather than waiting for a standards body to define them. The disagreement matters because both companies ship assistants that read personal data, and each has an interest in where the enforcement line sits.

For developers, the practical effect is more friction: apps that relied on blanket drive access will need to request narrower scopes or justify the broader entitlement during review. Security researchers have generally welcomed the direction, though some warn that vague enforcement can push legitimate tools toward workarounds. Enterprise backup and endpoint security vendors are the most exposed, since their products depend on scanning everything.

What remains unresolved is how Apple will treat AI agents that request full-disk access specifically to complete a user's task, rather than to index or protect data. The company has not published detailed criteria for those cases, and the review process for such entitlements is not transparent. Watch whether Apple issues developer guidance on agent permissions — and whether Meta or other vendors escalate the argument into a formal regulatory complaint.