Apple tightens macOS Full Disk Access, explicitly citing the risks AI agents introduce

Apple's proposed fix and its timeline are both notably restrained. The company says it will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action. Apple puts the motive squarely on AI: as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially. The company calls addressing this critical and commits to making sure users clearly understand the risks before granting access, so they can make informed decisions about their own data and privacy. Two details matter just as much, though: the post gives no effective date and names no macOS version, and MacRumors states plainly that Apple did not say when the new controls will be implemented. The announcement also names no developer or app.

To judge the weight of this tightening, look first at what the permission actually covers today. Apple's Mac User Guide explains that Full Disk Access lets an app access all files on the computer, including data from other apps such as Mail, Messages, Safari and Home; data from Time Machine backups; and certain administrative settings for all users on the Mac. The switch lives in System Settings under Privacy & Security, and adding an app requires clicking the Add button, selecting the app in the list and clicking Open. A separate Files & Folders category lists apps that have requested access to files and folders in specific locations. Notably, Apple's Platform Security guide frames the whole model as full transparency, consent and control for users — and Full Disk Access is precisely the channel that largely bypasses those default controls, which explains Apple's unusually heavy phrase about an extraordinary level of access.

On Macs enrolled in device management, Apple had already built this path — it was just aimed at enterprises. Per Apple's Platform Deployment guide, organizations can manage the Privacy pane settings through the Privacy Preferences Policy Control payload, identified as com.apple.TCC.configuration-profile-policy. That payload requires user approval, must be installed through a device management service, supports Device Enrollment and Automated Device Enrollment, and requires supervision when delivered through such a service. Inside it, the System Policy All Files service is what grants specified apps access to data such as Mail, Messages, Safari, Home and Time Machine backups; organizations building a custom payload must specify a bundle ID or file path, whether access is allowed or denied, and the code-signing requirement, which the guide says can be obtained by running codesign -dr - on the app or binary. The guide also notes that when more than one payload of this type reaches a device, the more restrictive setting wins. In other words, enterprises have long had a fine-grained allowlist path, while the consumer side largely had a single all-or-nothing switch.

The timing is not arbitrary either. MacRumors notes the announcement arrives amid the rise of always-on AI agents such as Meta's Muse and OpenAI's Dots, which have prompted privacy concerns, and Apple's own post says that for communication apps, over-broad access can compromise the privacy of third parties a user is communicating with. The practical impact on developers: if an app relies on Full Disk Access for something other than backup, it will need a justification a user can actually understand, because the authorization path becomes a very explicit user action rather than a click in Settings. For ordinary users the action item is oddly empty — Apple has not said when this takes effect or in which release. The useful thing to do today is open Privacy & Security on your Mac and check which apps currently hold this permission.