Apple sounds the alarm on AI agents and 'Full Disk Access'

Apple is adding new safeguards to how "Full Disk Access" works in macOS to address the growing risk posed by AI agents. In an update, the company warned that the increasingly popular tools "could put users at risk," and that it would add "additional controls" to the process to ensure users are aware of what they're doing when they grant software such "extraordinary" access.

The company didn't say when the update would roll out or what exactly would change from the current setup. But in its note, the Cupertino company implied that some developers of AI agents are not being upfront with users about the privacy tradeoffs that come with using their software.

"Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users' full knowledge and understanding," the company said. "For communication apps, this can also compromise the privacy of the people users are communicating with."

Desktop clients for AI agents, like OpenClaw, Dots and Muse, often encourage users to grant "Full Disk Access" so the agents can access their files, messages and other data. This allows AI agents to accomplish more kinds of tasks, but it also comes with significant risks. That's why some people opt to use agents on dedicated machines, which has helped fuel Mac Mini shortages this year.

More recently, the issue of agents getting Full Disk Access has cropped up again with the rise of Meta's AI agent, Muse. Though Apple doesn't specifically cite Muse or Meta, its warning comes after some users have reported that Muse took unintended actions with their data. Jason Aten, a tech columnist for Inc. recently wrote about how the Muse Mac app was able to access his messages even though he thought he had denied that permission. Meta responded saying that if his messages synced, he must have opted in.

Apple, it seems, wants to add additional friction to make sure people are aware of what they are allowing their agents to see. "Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action," the company said. "Addressing this is critical. As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially. We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy."