A Mac permission that gives apps broad access to protected data is drawing new scrutiny as AI agents become more autonomous. Apple warned on Oct. 2 that Full Disk Access can expose files, Mail, Messages, browsing history, and other sensitive information.
Apple plans additional controls requiring “very explicit user action” before an app receives that level of access, but it has not said when they will arrive or whether existing permissions will be affected. Organizations managing Mac fleets should review current grants rather than wait for Apple’s changes.
Full Disk Access expands an agent’s reach
Apple says Full Disk Access bypasses much of the normal macOS privacy-control model so software such as backup apps can reach protected data. Its Oct. 2 developer notice warns that some developers are requesting the permission in ways users may not fully understand.
Apple’s Privacy Preferences Policy Control documentation says the “System Policy All Files” setting can authorize access to Mail, Messages, Safari, Home data, Time Machine backups, and certain administrative settings. An AI agent with that access may also connect to browsers, cloud apps, messaging services, or other business systems, increasing the number of places sensitive data can move.
Recent Muse incidents illustrate the risk. Meta patched a Muse flaw in September that could let a local process redirect the agent’s voice-dictation traffic and potentially abuse privileges already granted to the assistant. Separately, Inc. columnist Jason Aten reported that Muse referenced Messages content he believed he had not authorized it to access; Meta disputed his account, saying both Full Disk Access and the Messages connector must be enabled before Muse can read Messages content.
Reduce privileges before Apple’s new controls arrive
Administrators and users can review approved apps under System Settings > Privacy & Security > Full Disk Access, while managed environments should also inspect privacy permissions distributed through device-management profiles. Recent agent-containment failures, including OpenAI pausing advanced work after an internal model reached the internet through an unintended DNS route, reinforce the need to review what agents can access and where they can connect.
Organizations can further reduce exposure by taking these steps:
- Inventory AI agents and privileged access. Identify sanctioned and unsanctioned agents, then document Full Disk Access, sensitive macOS permissions, and managed grants.
- Apply least privilege across local and cloud services. Remove unnecessary access and narrow permissions to email, messaging, cloud storage, repositories, and other systems.
- Restrict high-risk actions and destinations. Limit tools and command execution, use allowlists where practical, apply egress controls, and require human approval for destructive or externally visible actions.
- Treat external content as untrusted input. Account for indirect prompt injection delivered through email, webpages, documents, and other content agents process.
- Monitor agent behavior for anomalies. Watch endpoint, authentication, network, and SaaS telemetry for unusual file access, processes, connections, or data transfers.
- Test incident response plans for AI-agent misuse. Exercise prompt injection, compromised-agent, credential exposure, and data-exfiltration scenarios so teams can revoke access, disable integrations, contain systems, and preserve logs.
Apple’s agentic-security guidance recommends safeguards including user confirmations, sensitive-data redaction, authentication, and controls around untrusted input. Apple has not announced a release date for its new Full Disk Access controls or confirmed whether existing grants will be revisited.
Read more: Malicious extensions can also influence trusted agent workflows, as demonstrated by the BragJack technique for hijacking AI browser agents.