Mac Full Disk Access gets stricter over AI agents

Apple’s Full Disk Access change is a consent step, not a ban

Apple is not removing Full Disk Access. It is adding a stricter consent step before any app can get it. The announcement went up on Apple's developer news site on October 2, 2026, and says future grants will require "very explicit user action."

Apple framed the permission as an exception to its own rules. macOS gives developers powerful APIs but wraps users' private data in a set of controls, and Full Disk Access skips most of those controls so backup apps can work. According to Apple, some developers now lean on it in ways users don't fully understand, so files, mail, messages and browsing history end up open to the app.

Early coverage called this a limit. TechCrunch first described Apple as "limiting" permissions, then corrected the story to say the change is about informed consent and is not a new limit. That matches Apple's own wording, which talks about additional controls rather than taking anything away.

Apple says AI agent security makes Full Disk Access riskier

Apple's argument is that an AI agent with Full Disk Access can do far more with that data than a regular app. An AI agent here means software that acts for you on its own: it opens apps, reads files and carries out multi-step tasks without a person approving each one. As those agents get more capable and run more independently, Apple says the risk tied to whole-disk access grows a lot.

Apple also flagged a cost that lands on other people. When the app in question handles your conversations, the exposure reaches the people you talk to, not just you. The goal Apple describes is to make sure users see the risk before they say yes.

No date or macOS version yet for the new rules

Apple has not said when the stricter rules will ship, which macOS release will carry them, or what the new prompt will look like. The Verge noted the missing timeline, and TechCrunch said Apple did not answer its questions about the change.

The apps most likely to notice are the ones built around Full Disk Access. That includes backup software, its original use case, and AI agent apps that read across the whole Mac. If you rely on either kind, you may be asked to confirm the permission again once the update lands, but Apple has not said how existing grants will be handled.

Apps that never asked for Full Disk Access are not part of this announcement. Plenty of AI features on the Mac work through narrower permissions instead, as covered in ChatGPT Apple Messages: iMessage, SMS, RCS on Mac. Whatever an app uses, the list of what you've granted lives in macOS, not in the app.

Full Disk Access reaches Time Machine backups and app data

An app with Full Disk Access can read every file on the Mac, including other apps' data and your Time Machine backup data. Apple's Mac User Guide for macOS 27 lists what that covers:

• Data that other apps keep for every user on the Mac, such as Mail, Messages, Safari and Home
• Data stored in Time Machine backups
• Certain administrative settings

That reach is what sets it apart from the nearby Files and Folders setting. Files and Folders lets you switch access on or off per app for specific locations, such as your Desktop or Documents folder. Full Disk Access has no such boundary, which is why backup tools ask for it: they can't copy a whole drive without reading all of it.

The Meta Muse dispute over reading Messages

Apple named no company, but its post landed days after a public dispute over Meta Muse and a user's messages. Jason Aten, a columnist at Inc., reported that Meta's Muse AI agent seemed to know what was in his messages even though he had not given it permission, according to The Verge and TechCrunch.

Meta pushed back. Spokesperson Andy Stone told The Verge that Messages access is opt-in and that Muse can only read Messages content when the user turns on both Full Disk Access and the Muse Messages connector. Apple has not weighed in on which account is right.

Even on Meta's account, the takeaway is the same. Once an agent holds Full Disk Access, the Messages database on that Mac is within its reach, and the moment of granting it is the point Apple now wants to slow down.

macOS 27 lists Full Disk Access apps in Privacy & Security

You don't need to wait for Apple's update to see which apps have Full Disk Access on your Mac. In macOS 27 it takes three steps.

Go down the list and ask of each entry whether it is a backup tool or something you knowingly set up to read the whole drive. An app you don't recognize, or one you stopped using, can be switched off on the spot. Be careful with backup software, though, because it will stop working properly without the permission.

Also keep in mind who handles the data afterward. Apple's guide notes that when you give third-party apps access to your files, anything they collect falls under their own terms and privacy policies. For an AI agent with Full Disk Access, that means the developer's policy, not Apple's, governs what happens next.

Full Disk Access stays, but granting it takes more steps

Apple is keeping Full Disk Access on Mac but making people mean it when they grant it. The company tied the change to AI agents, which can do much more with whole-disk access than the backup apps the permission was built for.

There is no release date or macOS version yet. Until there is, the useful habit is simple: open the Full Disk Access list before you approve an AI agent, and check what is already there.