Full Disk Access on a Mac used to be the kind of permission you granted to, like, your backup software or maybe a antivirus tool. Now Apple is apparently watching a bunch of AI agents ask for the same keys to the kingdom, and the company does not sound thrilled about it.

So What Did Apple Actually Say?

In an update, Apple warned that the growing wave of AI agent apps “could put users at risk,” and said it’s adding “additional controls” to how Full Disk Access works on macOS. The company didn’t give a timeline. It didn’t say exactly what’s changing, either, which, I’ll be honest, is kind of annoying if you’re trying to figure out what’s actually coming. But the message underneath the vague corporate language is pretty clear: some AI developers are not leveling with their users about what they’re signing up for. (Sorry, I know I just used a word I said I wouldn’t use elsewhere in spirit, but it fits here, so.)

Here’s the actual line from Apple, and it’s worth sitting with for a second: “Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems-including files, mail, messages, and even browsing history-without users’ full knowledge and understanding.” Apple added that for communication apps specifically, this doesn’t just put the user at risk. It can expose the privacy of whoever that user is texting or emailing too. That’s the part that should give people pause. You didn’t agree to let an AI agent read your friend’s messages. Your friend definitely didn’t agree to it either.

Why This Permission Is Such a Big Deal

Full Disk Access is not a casual permission. It’s basically the master key. Once an app has it, there’s no more “well it can only see this folder” nuance, it can see everything, mail, messages, browser history, documents, all of it. For years that was reserved for a small category of apps that genuinely needed system-level access to do their job, think disk cleanup utilities, backup tools, that sort of thing. Normal apps just didn’t ask.

And then AI agents showed up and suddenly everyone’s being asked to hand over the whole house key because the assistant needs to “help” with your files.

Who’s Actually Doing This?

Apple’s update points to a pattern among desktop AI agent clients. Tools like OpenClaw, Dots, and Muse reportedly encourage users to grant Full Disk Access so the agent can dig into files, messages, and other personal data to be more useful. And look, I get the pitch. An agent that can actually see your stuff is way more useful than one that can only answer questions in a vacuum. That’s the whole appeal, honestly. But “more useful” and “fully informed consent” are two very different things, and that’s where Apple seems to think things have gone sideways. Meta's own AI agent, Muse, has already drawn separate scrutiny for how it's reshaping the internet.

“Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems-including files, mail, messages, and even browsing history-without users’ full knowledge and understanding.”

The Part Nobody Really Talks About

What gets me is the third-party privacy angle. We talk about AI privacy risk almost entirely in terms of the person using the tool. Did you consent? Do you understand what you agreed to? Fine, fair questions. But what about the person on the other end of your messages who never installed anything, never clicked an “allow” button, never read a single permission prompt? Apple flagged this directly, saying compromised communication apps can expose “the privacy of the people users are communicating with.” That’s not a hypothetical. If your AI agent has Full Disk Access and it’s reading your Messages app, it’s reading what the other person wrote too. They had zero say in that. Meta's cute AI mascot has sparked its own privacy nightmare over how much it quietly knows about the people around its users.

This is the kind of thing that sounds abstract until you actually picture it. Somebody’s AI assistant quietly skimming through a years-old email thread, or scanning text messages from someone who has no idea an AI is anywhere near that conversation. Not great. Not great at all.

What This Actually Means

My honest read here, Apple is basically trying to get ahead of a mess before it becomes an even bigger one. Full Disk Access requests used to be rare and deliberate. Now they’re becoming almost routine for a whole category of apps, and the people granting that access often don’t fully grasp what they just unlocked. Apple adding “additional controls,” whatever that ends up looking like, feels less like a courtesy and more like damage control. That instinct to get ahead of trouble feels notable given OpenAI's recent safety team purge, which raised similar questions about who's actually minding AI risk.

Will this actually slow down the AI agent gold rush? Probably not much. Developers want the access because it makes their products better, and users will probably keep clicking “allow” because the alternative feels like a less capable assistant. But at minimum, this should be the moment people start reading permission prompts a little more carefully. Not because Apple told them to, but because the stakes here go beyond your own files. Somebody else’s privacy might be riding on that click too.