Apple Tightens macOS Full-Disk Access Rules

Apple is rewriting full-disk access. And it's finally saying out loud what security researchers have argued for weeks. On Friday, Apple announced it is changing macOS privacy settings so third-party developers can no longer quietly abuse them to reach into message histories and other sensitive user data, a move that confirms what critics have claimed since these permissions first drew scrutiny. They can't do it quietly anymore.

What Apple Actually Said

In a statement explaining the shift, Apple described the problem in blunt terms. Some developers, the company wrote, are using Full Disk Access in ways that could put users at risk, exposing everything on their systems,including files, mail, messages, and even browsing history,without users' full knowledge and understanding. Apple added a second concern that cuts deeper than the individual Mac owner: for communication apps, this kind of access can compromise the privacy of the people on the other end of a conversation.

Apple tied the change to the industry's direction. As AI agents become more capable and autonomous, the company argued that the risks attached to this level of access will grow substantially, and it's making that case now. The goal? Inform users first. They don't hand over permission blindly. So the stated goal is to make sure users understand those risks before they hand over permission, so they can make an informed call about their own data, because that call is theirs to make.

No app or developer was named. That omission matters.

The Incident That Started It

Two weeks before Apple's announcement, tech columnist Jason Aten reported that Meta's general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permission to read his messages and had assumed they were off-limits. The disclosure landed like a spark in dry grass.

Social media erupted, and the reaction was not subtle. Wave after wave of users compared AI assistants with access to calendars, emails, messages, and shopping accounts to a skill saw or another power tool. Useful, yes. Capable of real damage if handled carelessly, also yes.

Then came the pushback. Meta CTO David Singleton offered a rebuttal that, on its face, looked solid. For Muse to reach Apple Messages, he said, a user must manually grant two privileges: full-disk access at the macOS system level, and the Messages connector setting inside Muse. Without both, the door stays shut.

"The Messages integration in the Muse Mac app is opt in," Singleton said. "Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled."

The implication was plain. If Muse read Aten's messages, he had enabled both switches, and the blame sat with him, not Meta.

One Expert Wasn't Buying It

Patrick Wardle questioned the denial. He's a MacOS security expert, and his reasoning was narrow and technical. From a technical standpoint, he said, once full-disk access is granted, any non-root file becomes readable, and that means browsing history, browser cookies, chats, and more, because that access doesn't discriminate between the files you'd want kept private and the ones you wouldn't.

That raised an obvious question. How could Muse fail to read messages when every other app holding full-disk access can? When asked directly, Meta's public relations team did not answer. It simply requoted Singleton's original statement about opt-in consent and the two required settings.

Meta PR did not respond to questions sent Friday.

Muse's Troubles Pile Up

Apple's move landed 11 days after Wardle disclosed a Muse configuration that allowed any app or code running on a Mac to seize full control of the AI assistant. That includes commands injected through ClickFix attacks, which have grown increasingly effective. From that position, an attacker could reach the same resources Muse itself could.

Amazon added its own complication. The company blocked Muse from its platform, saying all such apps should operate openly and respect service provider decisions about whether or not to participate.

Stack those events together. A pattern emerges. Muse may not deserve the extraordinary access it needs to function as Meta advertises it, and anyone running the assistant should configure permissions with real care, though Aten's account suggests even that precaution has limits. It's a gap. We've seen it.

Why the Timing Looks Deliberate

Apple's statement never mentions Muse, Meta, or any other app by name. There are no known reports of other developers abusing full-disk access to read messages and browsing history, so it is entirely possible the announcement had nothing to do with the Muse episode.

The calendar is hard to ignore. And it's sitting right there, staring back at you. Coming on the heels of a major social media uproar, the odds of coincidence shrink, because you can't separate the timing from everything else that's already happened. At minimum, Apple's language appears to contradict Singleton's denial that Muse cannot read Messages content without the connector enabled, and that contradiction is the whole problem.

That contradiction is the quiet headline here. Apple full-disk access rules are changing because the permission model that worked for traditional apps does not scale to autonomous agents that browse, read, and act on a user's behalf.

What Changes for Mac Users

The practical effect is a tighter gate. Apple wants users to confront a clear explanation of what full-disk access exposes before they grant it, rather than clicking through a dialog they do not read. The categories Apple itself flagged as at risk are worth remembering:

• Files stored anywhere on the system
• Mail and message histories
• Browsing history and browser cookies
• Data belonging to the people users communicate with

For developers building AI agents, the message is equally direct. Broad system access? That's not a checkbox. It's not something buried in onboarding, either, and it's not the kind of thing Apple wants you to click past without thinking, because the company intends to make users actually sit with this decision. But they're going to notice. It's a choice.

Whether that is enough remains open. Apple full-disk access changes arrive as agents grow more autonomous, and the gap between what a permission grants and what a user believes it grants is exactly where incidents like Aten's are born.