Apple has announced plans to strengthen macOS controls for Full Disk Access, citing concerns that increasingly autonomous AI agents could raise privacy and security risks by giving applications extensive access to users’ devices.
In a developer update on October 2, Apple stated it will introduce additional controls for macOS Full Disk Access, a powerful permission initially designed to enable backup applications to function correctly.
This setting largely bypasses standard macOS privacy protections, allowing approved applications to access files, emails, Messages content, and browsing history.
Apple Strengthens macOS Privacy Controls
Apple noted that some developers are using the permission in ways that may expose users’ data without their “full knowledge and understanding.”
The company emphasized that the risk goes beyond the Mac owner; when communications applications have unrestricted access, the privacy of individuals communicating with the user could also be compromised.
While Apple did not disclose the specific technical design of the upcoming protections, the macOS version that will implement them, or a rollout date, it did mention that users who wish to grant an app this “extraordinary” level of access will need to take “very explicit user action.”
This move reflects a broader security concern: AI software that can autonomously inspect, organize, summarize, search, and act on locally stored data.
A traditional app with Full Disk Access typically uses this privilege for specific tasks, such as backup or endpoint protection. In contrast, an AI agent can continuously process large amounts of sensitive information and potentially send results to cloud services or use them to perform subsequent actions.
This makes Full Disk Access an appealing target for malicious, compromised, or overly permissive AI applications. If an agent is misled through prompt injection, compromised through a supply-chain attack, or set with unsafe automation rules, its extensive operating-system privileges could transform a localized issue into widespread data exposure.
For instance, an agent with access to a Mac’s entire file system could encounter sensitive corporate documents, saved credentials, browser data, email archives, chat histories, source code, and personal records.
The security concern is not just whether an app can read a single file, but whether it can autonomously analyze and act upon data across the entire system.
Apple’s announcement reinforces a fundamental principle of endpoint security: privileged access must be proportional to the task and should be granted through deliberate, informed consent.
Organizations deploying macOS AI tools should evaluate which applications currently have Full Disk Access and determine if each approval is still necessary.
Security teams should also differentiate between tools that require limited access to specific folders or data types and those that request blanket access to user content.
For macOS developers, this change signals increased scrutiny of applications that request unrestricted system visibility. Developers should avoid treating Full Disk Access as a default requirement, clearly explain why it’s necessary, and provide functionality that operates with narrower permissions whenever possible.
Apple’s forthcoming safeguards position user consent as a critical defense against autonomous software with broad access. As AI agents evolve from passive assistants to systems that can perform complex tasks, maintaining strict OS-level permission boundaries will be essential for data protection.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
