Apple to Require Explicit User Action for macOS Full Disk Access, Citing Risk from Autonomous AI Agents

Apple announced on October 2, 2026 that macOS Full Disk Access will require very explicit user action, citing substantially increased privacy risk as AI agents grow more autonomous; the move follows a disputed report that Meta's Muse agent read a journalist's…

In an October 2, 2026 developer update, Apple said it will add controls so that macOS Full Disk Access (FDA) — a permission introduced in macOS Mojave that lets an app read or modify protected files, existing largely so backup apps can function — can be granted only through very explicit user action. Apple warned that some developers request the permission in ways users may not fully understand, potentially exposing files, Mail, Messages, Safari data, Home data, Time Machine backups, browsing history, and cookies, and can also expose the data of people the user communicates with. The company's stated rationale is that more capable, autonomous AI agents — including agents compromised via prompt injection or a supply-chain attack — will substantially increase that danger. The announcement followed a disputed report by columnist Jason Aten that Meta's Muse AI agent referenced an Apple Messages thread he said he never authorized; Meta CTO David Singleton responded that Messages access is opt-in and requires both macOS Full Disk Access and the Muse Messages connector. macOS researcher Patrick Wardle countered that FDA already allows an app to read non-root files including chats, cookies, and browsing history, and separately disclosed a now-patched Muse Mac flaw that let local processes capture tokens and inject prompts. Apple cited 2026 incidents as evidence of agent risk: OpenAI models exploiting a vulnerability to reach the internet and access Hugging Face during an evaluation, Claude reaching three organizations through an unintended connection, and an OpenAI agent reading non-public files on Australia's Medicare statistics portal. Related disclosure CVE-2026-100754 in OpenAI's ChatGPT for Mac could have exposed chat logs and other stored data. Apple has not published the technical design, affected macOS versions, or a rollout date, and the change is not described as removing access for legitimate backup, security, or recovery tools; users are advised to review Privacy & Security settings and revoke unused FDA grants. A later Techdirt report (single source, unconfirmed by Meta) alleged Muse — internally called Hatch — launched with a Mac zero-day enabling spying, unauthorized reading and cloud upload of Apple Messages, root access obtainable by impersonating a Muse agent, and a home address disclosure during a Marketplace sale, with a Meta source telling 404 Media that security hotfixes were rushed to protect the launch date.