The short version: On October 2, Apple said it will add new controls to Full Disk Access on macOS, because AI agents make that permission more dangerous than it used to be. Full Disk Access is a single switch. Apple’s own Mac User Guide says it lets an app read all the files on your computer, including data from Mail, Messages, Safari and Home, your Time Machine backups, and certain administrative settings for every user on that Mac. Apple built it so backup software could work.
You do not have to wait for Apple’s update to use what it is warning about. Open System Settings, click Privacy & Security, then Full Disk Access, and look at the list. On most small-office Macs it should hold your backup app and perhaps your security software, and very little else. It takes under a minute, and it tells you which apps can already read your customers’ texts.
What did Apple announce about Full Disk Access?
The note went up on Apple’s developer news page on October 2, 2026. Apple says some developers are using Full Disk Access in ways that expose files, email, messages and browsing history without users fully understanding what they agreed to. Its answer is extra controls so that people who really want to hand an app that level of access have to take deliberate, explicit steps to do it.
The reason Apple gives is about where software is heading, not a single bug. As TechCrunch reported, Apple wrote that as AI agents grow more capable and autonomous, the risks of this access “will grow substantially.” Apple did not say when the new controls arrive or which version of macOS carries them.
What does Full Disk Access actually open on a Mac?
Most Mac permissions are narrow. The same Privacy & Security page in Apple’s guide lists them one by one: Files & Folders lets an app reach specific locations, Accessibility lets it control the Mac, Automation lets it drive other apps, Screen & System Audio Recording lets it see and hear what is on screen. Each one is a door.
Full Disk Access is the building key. The places it opens are the ones macOS otherwise walls off from ordinary apps, including apps you trust: the database behind Messages, the mail stored by Apple Mail, your Safari history, and your backups. That is why backup software needs it. A backup that cannot read your mail is not a backup.
Here is the part that is easy to miss. Much of what sits behind that switch belongs to other people. If your iPhone’s texts sync to your Mac, the Messages database holds every text a customer, supplier or employee has sent you. Apple’s note makes the same point: the risk reaches the people you communicate with, who never agreed to have an AI read their words.
Why did AI agents change the math?
A backup app reads everything and does one predictable thing with it: copies it. An AI agent reads, decides and acts. Give an agent the building key and the question stops being what it can see and becomes what it might do with what it saw.
The case that made this concrete in the last two weeks involves Meta’s Muse agent. Inc. columnist Jason Aten wrote that Muse read his Messages on a Mac mini although he says Full Disk Access was switched off. Meta disputes it. In statements to TechCrunch, a Meta spokesperson said Muse can only read Messages on a Mac if the user turns on both Full Disk Access and the Messages connector inside the app, and an executive at Meta Superintelligence Labs described several separate permission steps that a bug could not skip.
We cannot settle that dispute, and we do not need to. Both sides agree on the mechanism: the macOS switch is the gate to your messages. Muse’s own approval system, which we walked through in Muse for Small Business: Your Yes Comes in Five Sizes, governs what the agent does. Full Disk Access governs what it can read in the first place. Apple is moving to make the second decision as deliberate as the first.
How do you check which apps have Full Disk Access?
On any Mac running a recent version of macOS:
1. Open the Apple menu, choose System Settings, and click Privacy & Security in the sidebar.
2. Click Full Disk Access. You will see every app that has asked, with a switch beside each one.
3. For each app that is switched on, ask one question: does this app’s job require reading my mail, my messages and my backups? A backup tool, yes. Endpoint security software often asks too. A note-taker, a writing assistant or a general AI helper usually does not.
4. Turn off anything that does not need it. The app may ask to quit and reopen. If something breaks, you can switch it back on in seconds.
Do the same on every Mac in the business, including the one at the front counter that everyone shares. Full Disk Access covers administrative settings for all users on that machine, not just yours.
What should you give an AI agent instead?
Take a two-person bookkeeping office where both partners work on Macs, client email arrives in Apple Mail, and the owner’s client texts sync from her iPhone. She wants an agent to draft month-end summaries from the reports she saves into one project folder. That job needs one folder. Granting Full Disk Access to do it would also hand the agent every client’s texts, years of email and the browsing history that shows which bank portals she logs into.
The narrower route is already built into macOS. Under Files & Folders, an app can be limited to locations such as Documents or Downloads, and many apps work fine with only the files you open in them or drop onto them. Make a folder for the agent’s work and keep its world that size. Inside the agent itself, use read-only connectors where they are offered.
Narrow access also shrinks a second problem. An agent that reads everything also reads instructions that strangers have planted in that everything: an email, a form submission, a message. That is how a contact form became an attack in Contact Form Prompt Injection: The Lead Was the Attack. The less an agent can read, the fewer strangers get a say in what it does.
None of this is a reason to stay away from agents. They are already taking real hours off owners’ weeks. Apple’s change is good news for the people using them: the most powerful permission on the Mac becomes a decision you make on purpose, not a box you click past. Making that decision a little early, this afternoon, costs nothing.
Frequently Asked Questions
What is Full Disk Access on a Mac?
It is a macOS permission that lets an app read all files on the computer, including data from Mail, Messages, Safari and Home, Time Machine backups, and certain administrative settings for every user on that Mac, according to Apple’s Mac User Guide. Apple says it exists so backup software can work.
Why is Apple changing Full Disk Access?
Apple said on October 2, 2026 that some developers use the permission in ways that expose files, email, messages and browsing history without users fully understanding it, and that the risk grows as AI agents become more capable and autonomous. It plans controls that require explicit user action before an app gets this access.
When will the new Full Disk Access controls arrive?
Apple has not said. Its developer note gave no date and no macOS version for the change, so the practical step for now is to review the Full Disk Access list yourself under System Settings, Privacy and Security.
Does an AI agent need Full Disk Access to be useful?
Usually not. Most agent jobs in a small business, such as drafting from reports or organizing files, need one folder or the specific files you hand them. Reading Messages is a case that does need it: Meta says Muse can only read Messages on a Mac with Full Disk Access and its Messages connector both turned on.
When you open that list today, what do you expect to find switched on that you never meant to grant? Tell us in the comments.
