Apple has signaled plans to overhaul how macOS handles Full Disk Access, one of the operating system’s most powerful privacy permissions, citing growing concern that AI agents could exploit the setting to see far more of a user’s digital life than intended. The company says the change will force a much more deliberate approval step before any app can be granted this level of access.

A High-Risk Permission Gets Riskier

Full Disk Access was originally designed to let trusted utilities, mainly backup and system-maintenance tools, bypass macOS’s normal privacy sandboxing when their function genuinely requires it. In practice, the permission is sweeping: an app granted Full Disk Access can reach files anywhere on the Mac, along with data stored by Mail, Messages, Safari, Home, and Time Machine backups, as well as select system settings. Apple already treats it as high-risk, requiring users to manually enable it through the Privacy & Security pane rather than through an in-app prompt.

According to Apple, some developers have been requesting this permission in ways that leave users with little real understanding of how much visibility they are handing over. The exposure is not limited to local documents; email contents, private messages, browsing history, and other records normally shielded by macOS’s privacy controls can all fall within scope. For communication apps in particular, that visibility can extend to other people on the other end of a conversation who never consented to anything.

Why AI Agents Change the Calculus

Apple’s core worry is that autonomous AI agents behave nothing like the single-purpose utilities Full Disk Access was built for. A conventional app performs one well-defined task and stops. An AI agent, by contrast, can pull information from multiple sources, reason over it, and independently decide on follow-up actions, chaining steps together without a human approving each one. Combine that autonomy with blanket disk access, and a single compromised or manipulated agent could potentially expose or act on a large swath of a person’s personal and professional data at once.

Apple has stated plainly that it expects this risk to grow as AI tools become more capable and more independent in how they operate, which is driving the company to revisit a permission model that has gone largely unchanged for years.

What’s Actually Changing

Apple has not yet published technical specifics: no release date, exact mechanism, or list of supported macOS versions has been confirmed. What the company has made clear is the direction, moving away from a simple on/off toggle and toward a flow that makes the scope of access unmistakable before a user approves it. Early indications suggest the update is meant to slow down the approval moment itself, rather than strip the capability from the tools that legitimately need it.

Importantly, Apple’s wording suggests backup utilities, security software, and recovery tools with a genuine need for deep file access will keep that capability. The target is the accidental or rushed grant, not the legitimate use case.

What Mac Users Can Do Now

Users do not need to wait for Apple’s update to reduce their exposure. Security guidance following this announcement points to a quick audit as the most effective immediate step:

• Open System Settings, then Privacy & Security, then Full Disk Access.
• Review every app currently listed and remove access for anything no longer in active use.
• Pay particular attention to desktop AI assistants, browser extensions, system-cleaning utilities, and chat or messaging apps, categories where the permission is most often granted without a clear ongoing need.

Part of a Larger Pattern

This announcement does not exist in isolation. It follows recent coverage of a macOS Transparency, Consent, and Control (TCC) bypass vulnerability, as well as broader warnings about AI agents being misused to carry out ransomware-style activity on compromised endpoints. Taken together, these developments suggest permission architecture, not just malware detection, is becoming one of the central battlegrounds in securing devices that increasingly run autonomous software with real-world reach. As AI agents take on more independent tasks on personal computers, how operating systems gate access to sensitive data may end up mattering as much as the capabilities of the agents themselves.