Apple to Restrict Mac Full Disk Access as AI Agents Raise Security Fears

Apple plans to add new restrictions on full disk access in macOS, the broad permission that lets an app read nearly everything on a Mac, after concluding that AI agents make the setting far more dangerous than it used to be. The company disclosed the change in an update published Friday, according to TechCrunch, which first reported the move. The shift targets a permission that security researchers have long considered one of the most powerful a Mac app can hold.

Full disk access bypasses macOS's normal sandboxing and privacy prompts, giving an app access to Mail data, Messages history, Safari files, Time Machine backups and other protected folders. Apple said the goal is to make sure users who genuinely want to hand an app that level of access can still do so, but only through clearer, more deliberate controls. The company did not give a ship date or say which macOS version will carry the change.

What is driving the rethink is the rise of AI agents: software that runs on a user's behalf, reads local files, clicks through apps and executes multi-step tasks with limited human supervision. An agent with full disk access can pull credentials, personal documents and private messages into a model's context without the user realizing the scope of what it can reach. A single compromised or misbehaving agent inherits the same reach as a trusted backup tool or antivirus utility.

Apple's move lands as rival platforms wrestle with the same problem. Microsoft has spent the past year hardening Windows against agent-driven attacks, and browser makers have added warnings around extensions that request broad page access. On the Mac, full disk access has been a standard ask for backup, sync and utility apps, so any tightening will force developers to justify the request or redesign around narrower permissions.

For Mac users, the practical effect should be fewer apps quietly holding the keys to the whole machine, though the details will decide how much friction arrives with the security. The open question is how Apple distinguishes a person granting access from an agent granting it on that person's behalf, and whether developers get a way to request scoped access instead. Apple has not said how it will enforce the rule, when the controls arrive, or what happens to apps that already hold the permission.

Security teams will be watching for the first developer documentation and beta builds, since those will reveal whether the change is a prompt tweak or a real architectural limit. Either way, the episode marks one of the first times a major OS vendor has rewritten a core permission because of AI agents rather than conventional malware.