Apple tightens macOS disk-access controls as AI agents raise privacy risks

What Apple announced

TechCrunch reported on October 2, 2026, that Apple is introducing additional controls around Full Disk Access on macOS. The company said the setting was designed so backups could function properly. It also said that AI agents have increased the risks associated with this level of access. Nothing in the published account describes a new Apple application, a shipping date, or a control that is already in effect.

The timing sits close to a contested report. Days earlier, Inc. columnist Jason Aten claimed that Meta's Muse app on Mac had read his private messages even though he said he had not given the AI agent permission. Meta disputed the claim. Apple did not respond to TechCrunch's inquiry about the feature change, so the record does not include a company explanation of timing, scope, or rollout.

What the setting allows

Apple's own description, as relayed by TechCrunch, is broad. Full Disk Access gives an app permission to access files, mail, messages, and browsing history. Desktop AI agents, the report explains, let users give their apps greater reach into files, messages, and other personal content by changing macOS settings. Muse, specifically, optionally allows users to turn Full Disk Access on. Optional is not the same as unused, and the source does not say how many people enabled it.

In a blog post directed at developers, Apple said some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems without users' full knowledge and understanding. That is Apple's assessment of a pattern of use. The source does not name the developers included in that assessment, does not describe a technical exploit unique to the permission, and does not say that granting the setting is itself a violation of Apple's rules. The stated problem is knowledge and understanding on the user's side, paired with extraordinary reach on the app's side.

The reports that preceded the statement

TechCrunch presented Aten's account as raising questions about the security and trust users place in desktop AI that can control things on a system and read files and messages. Those questions follow from the claim as reported. They are not findings. This account does not include Aten's full column, Meta's rebuttal, or any independent log of what Muse accessed. The dispute remains unresolved on the material assembled here.

A second, separate report also preceded Apple's decision. TechCrunch said a Wired account cited a flaw in ChatGPT's Mac app that could have allowed hackers to access sensitive data. The source text stops there. It does not describe the flaw, say whether it was exploited, identify affected users, or record a response from the app's maker. Treating that report and the Muse dispute as the same kind of failure would blur a distinction the record actually supports: one is a contested account of an agent reading messages despite a claimed lack of permission; the other is a reported vulnerability that could have enabled unauthorized access.

Consent, not a new limit

Apple said that, going forward, it will introduce new controls so users who genuinely wish to grant an app this extraordinary level of access can do so only with very explicit user action. In the same developer post, the company wrote that addressing this is critical. As AI agents become increasingly capable and autonomous, Apple said, the risks associated with this level of access will grow substantially. Apple added that it is committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.

A correction on the TechCrunch article is part of the factual record and should not be smoothed away. An editorial error had described Apple as limiting permissions. After publication, the author updated the wording to reflect the original intent: the change reflects informed consent, and it is not a new limit. An early description and the corrected description are not the same policy. The supported reading is a higher bar for how consent is expressed. What is not supported is a cap on the data categories Full Disk Access can reach, a ban on the setting, or a statement that existing grants will be revoked.

What the record does not establish

Analysis, distinct from the reporting above: nothing in the source is a financial disclosure. There is no revenue figure, no user count for Muse or for ChatGPT's Mac app, no estimate of how many Mac apps hold Full Disk Access, and no indication that Apple expects a material cost or benefit. For readers who follow Apple, Meta, and desktop AI, the usable signal is qualitative. Apple is telling developers that a permission once justified by backup utility now carries privacy risk that will demand clearer consent as agents grow more capable and more autonomous. Apple's statement that those risks will grow substantially is the company's judgment, not a published incident rate.

Further analysis: any commercial relevance sits outside disclosed financial results, which are absent here. The permission Apple is discussing reaches files, mail, messages, and browsing history. A consent standard built on very explicit user action would not, on these facts, prevent a user from allowing that same reach after taking the required action. It would change the clarity of the grant, which is the point Apple stated. Muse already presents the setting as optional. Whether the forthcoming controls will require a different presentation, and what will count as explicit enough, is not specified. Until those details appear, claims of safer user data, lost app function, or a competitive edge for Apple would go beyond the record.

Source

TechCrunch published this record on 2026-10-02. Pennington Financial accessed it on 2026-10-09.