Apple names the reason
Apple will add new controls around Full Disk Access on macOS, and said in a developer post on Friday that the growing autonomy of AI agents is why. The setting grants an application access to a user’s files, mail, messages and browsing history in one switch, and it exists because backup software needs it.
“Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding,” Apple wrote. “For communication apps, this can also compromise the privacy of the people users are communicating with.”
The company said that going forward it will “introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action.” It did not say which macOS release carries the change or when it ships.
The sentence that matters
The operative passage is the one that names agents directly. “Addressing this is critical. As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially,” Apple wrote. “We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.”
Platform vendors rarely explain a permissions change by pointing at a category of software. Apple did, and the category it pointed at is the one every other large company is shipping this quarter.
What prompted it
The post follows two incidents. Inc. columnist Jason Aten reported that Meta’s Muse app on the Mac knew the contents of his private messages, which he said he had not given it permission to read; Meta disputed the account. Separately, Wired reported a flaw in ChatGPT’s Mac app that could have let attackers reach sensitive data.
Apple did not respond to TechCrunch’s questions about the change, and its post names neither company. Full Disk Access is the common denominator in both cases: it is the one toggle that turns a desktop assistant into something with the same reach as the person using the computer.
The squeeze on desktop agents
The timing matters because the demand for exactly this access is rising. GitHub put computer use for Copilot into public preview on macOS and Windows this week, a feature that lets the assistant click controls, type into fields and move between desktop applications; on macOS it walks users through granting Accessibility and Screen Recording permissions to do it.
So the two sides of the same question arrived in the same week. Agent vendors need deeper system access to be useful on a desktop, and the platform owner has decided that the existing door is too wide to leave as it is.
What to watch is the mechanism. If Apple replaces a single toggle with scoped, revocable, per-purpose grants, agent developers will have to ask for less and ask more often. If it only adds friction to the same all-or-nothing switch, users will click through it the way they click through everything else.
