Apple to Tighten macOS Full Disk Access, Citing AI Agent Risks

Apple announced plans to introduce additional controls around Full Disk Access in macOS due to risks associated with the use of this permission, particularly as AI agents become more capable and autonomous. This change stems from concerns that developers have been utilizing Full Disk Access in ways that could expose sensitive user data, including files, mail, messages, and browsing history, without full user knowledge. Apple intends to enforce a model requiring "very explicit user action" for granting this access to ensure users can make informed privacy decisions.
Full Disk Access currently grants applications broad access to all files on the computer, including data from applications like Mail, Messages, Safari, Time Machine backups, and certain administrative settings. The system enforces consent through user interaction, with requests for files and folders handled via prompts, and full internal storage access requiring changes to system privacy settings. Furthermore, organizations using device management services can implement specific payload controls that manage this access, with the operating system applying the most restrictive setting if multiple controls are present.

* Apple announced plans to introduce additional controls around Full Disk Access in macOS on October 2, 2026.
* The change is based on concerns that developers' use of this permission could put users at risk due to increased capability of AI agents.
* Full Disk Access largely bypasses controls in Apple’s developer APIs for backup applications.
* Some developers use Full Disk Access to expose files, mail, messages, and browsing history without full user knowledge.
* Apple stated that coming controls will require "very explicit user action" for granting access.
* The goal is to ensure users understand the risks before granting access and make informed privacy decisions.
* Full Disk Access allows apps to access all files on the computer, including data from Mail, Messages, Safari, Home, Time Machine backups, and administrative settings.
* Requests for files and folders are handled via prompts, while full internal storage access requires editing system privacy settings.
* Device management services use payloads to manage these settings; the system applies the most restrictive setting when multiple payloads are delivered.

The introduction of heightened controls around Full Disk Access reflects a structural tension between developer utility (like backup functionality) and fundamental user privacy. The core pattern here is the shift from implicit, broad access to explicit, granular consent, directly acknowledging that technological advancement (AI autonomy) outpaces existing security/privacy frameworks. This signals a recognition that opaque permissions create systemic risk, especially when autonomous entities can leverage such access to aggregate sensitive information across applications.
The mechanism by which system administrators manage this access via device management payloads reveals a layer of institutional control layered on top of user-level consent. The fact that external services impose their own rules (payloads) on internal system permissions demonstrates a fragmented locus of control over data exposure. The implication is that cognitive sovereignty requires not just explicit permission for an application, but a clear understanding of how that permission interacts with emergent technologies like autonomous agents.
The unanswered question is whether the proposed controls are sufficient to mitigate risks when AI agents evolve beyond current threat models. If autonomous systems can rapidly process and correlate data across seemingly siloed applications (mail, browsing history, local files), then the principle of explicit user consent must be re-evaluated not just as a gateway check, but as an active defense mechanism against emergent aggregation threats. What framework exists to assess the aggregate risk exposure created by accumulating access permissions over time?