Apple Tightens Mac Full Disk Access. Which AI Agents Already Have It?

Apple Tightens Full Disk Access on the Mac, and Names AI Agents as the Reason

On October 2, 2026, Apple announced on its developer news site that it will add new controls to Full Disk Access on macOS. Once they arrive, a user who wants to give an app this level of access will only be able to do so through "very explicit user action." Apple tied the change directly to AI agents: as they become more capable and autonomous, it said, the risks of this access "will grow substantially." For a business, the useful step does not wait for Apple: open the Full Disk Access list on every company Mac today and ask why each app on it is there.

What Apple actually announced

Full Disk Access is the setting that lets an app read almost everything on a Mac. Apple explains that it largely sidesteps the privacy controls that normally protect user data, and that it exists so backup apps can work properly. The problem, in Apple's words:

"Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users' full knowledge and understanding."

Apple added a point that matters to any company that talks to its customers: for communication apps, this access can also compromise the privacy of the people users are communicating with. In other words, the risk does not stop at the employee whose Mac it is. It reaches every customer, supplier and colleague in that employee's mail and messages.

What Apple did not say

The announcement is short, and the gaps matter as much as the text:

• No date: Apple said "going forward" and gave no timeline.
• No macOS version: the post does not name the release that will carry the change.
• No technical details: it does not describe what the new consent step will look like, or how it will treat apps that already have access.
• Nothing on managed devices: it does not say whether access granted through a company's device management system will be affected.

So do not plan around details that have not been published. Plan around the direction, which is clear: Apple is making this permission harder to grant, and AI agents are the stated reason.

Why AI agents changed the equation

A backup app reads your files and copies them. That is a narrow, predictable job. An AI agent reads the same files and then decides what to do with them: summarize, reply, send, upload to its provider's cloud. Always-on agents keep working in the background between conversations. TechCrunch reported that Apple's announcement comes as such agents spread, including Meta's Muse and OpenAI's dots, after an Inc. columnist wrote that Muse read his private messages (Meta disputed his account) and after Wired reported a flaw in the ChatGPT Mac app that could have exposed sensitive data to hackers. We covered how dots decide what to do without asking in our article on dots; Full Disk Access is the other half of that question: what the agent can see in the first place.

Check your company Macs today

This takes minutes per device, and it does not need to wait for any update:

• Open the list: System Settings, then Privacy & Security, then Full Disk Access. Every app with its switch on can read mail, messages, browsing history and documents.
• Ask one question per app: does it need to read everything to do its job? A backup or security tool may. A writing assistant, a meeting note-taker or a general AI agent usually does not.
• Turn off what has no answer: removing the permission does not delete the app. If something breaks afterwards, you learn exactly what depended on it.
• Write a clear rule: no employee grants this permission to a new app, especially an AI agent, without approval from whoever is responsible for IT in the business.

If your company manages its Macs centrally

Businesses that enroll their Macs in a device management (MDM) service can control this permission from one place. Apple's platform deployment guide documents a privacy policy with a service called SystemPolicyAllFiles, which, in Apple's description, allows specified apps access to data like Mail, Messages, Safari, Home, Time Machine backups and certain administrative settings for all users of the Mac. Review the policies you push to your devices now: a grant made years ago for a legitimate tool may today cover a tool you no longer use. Apple has not said whether the new controls will change how managed grants work, so read the release notes of upcoming macOS updates before you roll them out to staff.

If you build a Mac app or an AI agent

When the stricter consent arrives, some users will say no. An app that cannot work without Full Disk Access will lose them. The safer design is to ask for the narrowest access that does the job: let the user pick a specific folder or file, explain in plain language why you need it, and build a path that still works if the answer is no. This is how we approach any app or agent that touches company data at Origami: start from the minimum access, log what the agent reads and does, and keep sensitive actions behind human approval, as we explained in our article on coding agents that ran an attacker's command without asking.

Customer data and the Personal Data Protection Law

If an agent with Full Disk Access reads an employee's mail and messages, it is reading your customers' personal data, and it may send that data to a provider outside the Kingdom. The Personal Data Protection Law, supervised by SDAIA, sets obligations on how that data is processed and transferred. Before approving any agent on a work device, know what it reads, where it sends what it reads, and who your contract is with. Our PDPL guide for businesses covers the basics.

Sources

• Apple Developer: Updates to Full Disk Access in macOS (October 2, 2026)
• Apple Platform Deployment: Privacy Preferences Policy Control payload
• TechCrunch: Apple says it's tightening macOS Full Disk Access controls due to new risks from AI agents
• SDAIA: Personal Data Protection Law