Apple to Restrict macOS Full Disk Access as AI Agents Raise New Security Fears

Apple confirmed it plans to tighten the Full Disk Access permission in macOS, the system-level switch that lets apps read protected folders such as Mail, Messages, Safari history, and Time Machine backups. The company said the change is a direct response to a new class of software: AI agents that run on a user's machine and can act on their behalf across multiple apps. Full Disk Access was built for utilities and backup tools, not for autonomous assistants that chain actions together, and Apple now says that mismatch has become a security problem.

The permission has long been one of the widest grants on a Mac. Once an app is toggled on in System Settings, it can read data from nearly every protected location without further prompts, and macOS does not ask again each time the app opens a new file. That design worked when the typical holder was a disk-cloning utility or an endpoint security agent. It becomes harder to defend when the holder is a model-driven agent that decides on its own which files to open and can be steered by text it reads from a web page, an email, or a document.

The risk is not hypothetical for anyone following prompt injection, the technique where instructions hidden inside content trick an AI system into taking unintended actions. An agent with Full Disk Access and a network connection has everything it needs to gather credentials, personal messages, or financial records and send them out, and the user may never see a prompt. Apple's warning echoes concerns security researchers have raised since desktop agents began shipping in volume: the operating system's permission model assumes a human is in the loop for each sensitive step, while agents are designed to remove exactly that friction.

Apple has not said what the new controls will look like or when they will ship, and the company has not detailed whether existing apps will be grandfathered in or forced to re-request access. Possible directions include per-folder grants, time-limited access, or requirements that agent frameworks declare which data categories they need. Developers who build Mac utilities and AI assistants will be watching closely, because any narrowing of Full Disk Access forces rewrites of onboarding flows and could break tools that depend on a single blanket approval.

The move also puts Apple ahead of its peers on a question regulators have only started to ask: who is liable when an autonomous program reads the wrong file. Microsoft, Google, and a crop of startups are all pushing agents onto the desktop, and each depends on the same broad permissions that Apple is now revisiting. If Apple ships meaningful limits, it sets a template other platforms may have to match, and it gives app makers a clear signal that blanket access is no longer the default path to shipping an agent.

What to watch next is timing and teeth. Apple has a history of announcing privacy changes well before they arrive, and the details will decide whether this is a real constraint or a warning label. The open question is whether per-app, per-folder consent can coexist with agents that are supposed to work across your whole machine without stopping to ask. Apple has not answered that yet, and neither has anyone else.