macOS Full Disk Access: Apple to Tighten It, Citing AI Agents

Full Disk Access is the one macOS permission that switches off most of the others. On October 2, 2026, Apple used a short post on its developer news site to say that granting it is going to get harder, and it gave AI agents as the reason.

The post runs fewer than 200 words, describes no new screen and sets no deadline. Still, Apple is saying in public that a permission it designed is being used in ways that could put its own users at risk. The list of apps holding it is already on your Mac.

Key Takeaways

• Apple said on October 2, 2026 that it "will introduce additional controls" so Full Disk Access can be granted only "with very explicit user action."
• Apple's post names no macOS version, no date and no mechanism, and MacRumors reported that Apple "did not say when" the controls will arrive.
• Full Disk Access opens "data from other apps (for example, Mail, Messages, Safari, and Home)" plus Time Machine backups, according to Apple's Mac User Guide.
• ~/Library/Mail, where Apple Mail keeps the messages it has downloaded, including those from a Gmail account you add to it, returned "Operation not permitted" to a shell without the grant in our macOS 26.7.1 test.
• The command tccutil reset SystemPolicyAllFiles plus an app's bundle ID resets that one app's Full Disk Access decision, per the tool's manual; we did not run it against a live grant.

What Did Apple Announce About Full Disk Access?

Apple announced that it will add controls making Full Disk Access harder to grant, without saying what they are. The post, titled "Updates to Full Disk Access in macOS," opens with an admission: "Full Disk Access largely sidesteps these controls in order to allow backup apps to function properly on the Mac."

Then the complaint. "Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users' full knowledge and understanding."

And the promise: "Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action." It adds: "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."

Here is what the post leaves out:

• Which macOS release. No version number appears in the text.
• When. MacRumors wrote that Apple "did not say when" the controls will be implemented.
• What "very explicit user action" means. No dialog, API or setting is described.

TechCrunch said Apple did not respond to its inquiry, and corrected its own story, which first described Apple as limiting permissions: the change "reflects informed consent, but is not a new limit." On Apple's current wording, no category of app is banned.

Why Now? Muse, Dots and a ChatGPT Bug

Apple does not say why now, and its post names no app or company. MacRumors tied it to always on agents such as Meta's Muse and OpenAI's Dots.

Inc. columnist Jason Aten reported that Muse for Mac had read his Messages without permission; Meta disputes that and says the feature needs Full Disk Access plus a separate connector. We covered both sides of the Muse dispute the same day.

The same morning, Wired reported a patched flaw in ChatGPT's Mac app, found by the Objective-See Foundation, that could have let malware already on a machine take over the app and reach its chat logs. "Agents need a lot of access to do their job," researcher Patrick Wardle told Wired. "They are like the building manager who has access to the keys to all the rooms."

Neither story is a proven abuse of Full Disk Access: one is contested, the other was a broken trust check between app components. What they share is the building manager problem.

What Does Full Disk Access Actually Unlock?

Full Disk Access lets an app read the folders macOS otherwise walls off from every other app. Apple's Mac User Guide describes it as allowing apps "to access all files on your computer, including data from other apps (for example, Mail, Messages, Safari, and Home), data from Time Machine backups, and certain administrative settings for all users on this Mac."

Under the hood it is one entry in TCC, the Transparency, Consent and Control system: the service kTCCServiceSystemPolicyAllFiles, a string we found in the tccd daemon on macOS 26.7.1. Apple's device management documentation defines it in one line: "Allows the application access to all protected files, including system administration files."

We tested the wall on that Mac from a shell without the grant. Listing each of these folders failed with "Operation not permitted":

• ~/Library/Mail: Apple Mail's local copies of your messages.
• ~/Library/Messages: home of the Messages database at the center of the Muse dispute.
• ~/Library/Safari: Safari's data, including the "browsing history" named in Apple's post.

One detail the coverage cited here skips: this permission already cannot be granted from a popup. Apple's Platform Security guide says apps that require access to the full storage device "need to be explicitly added in System Settings." So Apple is not adding a first consent step. The implication is that a trip to System Settings no longer counts as explicit enough.

Why Is an AI Agent With Full Disk Access Different From a Backup Tool?

A backup tool copies files without acting on what they say, while an agent reads them and decides what to do next based on the content. That turns every readable file into possible instructions.

The OWASP entry on prompt injection, LLM01:2025, is blunt: "Indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files." A mail folder is full of files written by strangers. An agent that reads all of them and can reach the network can be told, by one of them, to send the rest somewhere. We have already seen AI browsers obey hidden orders buried in an email.

Developers have a second exposure. In a 2024 Apple Developer Forums thread, Quinn "The Eskimo!" of Apple Developer Technical Support explained that for a tool "Run by the user from Terminal," the "responsible code is Terminal." If your terminal holds Full Disk Access, a command line agent launched inside it can work under that grant without showing up in the settings list under its own name. He also warned that the exact algorithm "is not documented."

What This Means for Your Inbox

If you added a Gmail account to Apple Mail, the messages Mail has downloaded sit on your disk, and Full Disk Access covers them. An agent holding that grant needs no Gmail password and no OAuth consent screen to read them. It reads files.

Google cannot show you this. Its linked apps page covers apps you linked to your Google Account, and a program reading Mail's folder never asked Google for anything. The place to look is the Full Disk Access pane.

Apple's post flags the other half: "For communication apps, this can also compromise the privacy of the people users are communicating with." People who emailed you are in that folder, and none of them agreed to an agent. The iPhone has no equivalent. On iOS, John Gruber notes at Daring Fireball, "There is no level of permission that grants third-party apps permission for such things."

What Changes for Developers?

Nothing changes yet, because Apple's post names no API, beta or date. The worry is scope. At MacStories, John Voorhees called the backup framing "nonsense," writing that on his MacBook Pro "only a handful of apps to which I've granted Full Disk Access are backup apps." His list includes Alfred, PopClip, Hazel and Apple's own Pixelmator Pro. He fears the post "could signal that the company intends to restrict the kinds of apps that can use Full Disk Access."

Apple has a precedent for what explicit can mean. During the macOS Sequoia betas in 2024, 9to5Mac reported that Apple's "initial plan was to prompt users to grant screen recording permissions weekly" before it settled on monthly. Nothing in the new post says Full Disk Access will work that way.

Two things are worth doing before details land:

• Ask for less. Apple's device management documentation lists separate services for the Desktop, Documents and Downloads folders. An agent that works inside one project folder needs none of what Full Disk Access adds.
• Check managed fleets. Device management profiles can carry SystemPolicyAllFiles as a service. Apple has not said whether the new controls touch access approved that way.

How Do You Audit Full Disk Access Today?

Open the Full Disk Access pane and switch off anything that does not need it. No new macOS release is required.

1. Read the list. Go to System Settings, then Privacy & Security, then Full Disk Access, as Apple's guide describes. Turn off every app you do not recognize or no longer use.
2. Test your terminal. Run ls ~/Library/Mail. If you get "Operation not permitted," that terminal does not hold the grant. If you get a listing, it does, and tools you start there can use it too.
3. Revoke from the command line. The tool prints its usage as tccutil reset SERVICE [BUNDLE_ID], so one app is tccutil reset SystemPolicyAllFiles com.example.agent. Find the real identifier with osascript -e 'id of app "Mail"', which printed com.apple.mail for us. Keep the bundle ID: per the manual, "If a bundle identifier is specified, the service will be reset for that bundle only." Without one, your backup tool loses access too.
4. Check the agent's own connectors. Full Disk Access is one door. A Gmail connector inside the agent is another, and it is managed in your Google Account.

A caveat: we checked the syntax against the tool's own output and the service name against tccd on macOS 26.7.1, but did not run the reset against a live grant.

Looking Ahead

Two open questions decide how much this matters. Is the new step a single scarier confirmation or a recurring one? And does Apple narrow which apps may ask at all? Apple has not said which macOS release will answer either.

There is an irony here. Apple says it will raise the bar for outside agents on the Mac in the same season its own assistant gained reach: the EFF warned in September that iOS 27's Siri can read app content and what is on your screen. Whoever builds the agent, check what it can reach in the operating system's settings, and do it before the update arrives.