Apple Tightens Full Disk Access Permissions After Meta Dispute

Apple is changing how macOS handles its Full Disk Access permission, the company said Friday, after a dispute over whether Meta's AI agent Muse improperly read a user's private messages. The decision follows a public back-and-forth between a tech columnist, a macOS security researcher, and Meta's chief technology officer over what one system-level toggle actually allows an app to do, Ars Technica reported.

What triggered Apple's move?

The dispute started two weeks before Apple's announcement when columnist Jason Aten said Muse, Meta's general-purpose AI assistant, sent him an unsolicited notification referencing a thread between him and a co-worker in Apple Messages. Aten said he never granted Muse permission to read his messages and believed they were off-limits, according to Ars Technica. The account spread widely, with users comparing AI agents holding broad system access to a power tool capable of real damage if mishandled.

How did Meta respond, and why wasn't that the end of it?

Meta CTO David Singleton pushed back directly. "The Messages integration in the Muse Mac app is opt in," Singleton said, according to Ars Technica. "Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled." His point was that Aten would have had to flip two separate switches — the OS-level Full Disk Access permission and an in-app Messages connector — for Muse to see anything.

That explanation didn't satisfy macOS security researcher Patrick Wardle, who told Ars Technica that the technical reality cuts the other way: "From a technical point of view, with FDA (full-disk access), any (non-root file), is readable, browsing history, browser cookies, chats, etc etc etc." When Ars Technica asked Meta how Muse could have Full Disk Access without being able to read messages, like every other app holding that permission, the company's only reply was to requote Singleton's original statement.

What is Apple actually changing?

Apple did not name Meta or Muse in its announcement, and the company said it has no confirmed reports of other apps abusing the permission the way Aten described. But Apple's statement made clear the underlying concern isn't limited to one developer. "Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems — including files, mail, messages, and even browsing history — without users' full knowledge and understanding," Apple said in its Friday statement, as reported by Ars Technica. "For communication apps, this can also compromise the privacy of the people users are communicating with."

Apple added that the stakes are rising specifically because of autonomous software: "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially. We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy."

Why does Full Disk Access matter for AI agents specifically?

Full Disk Access is a single macOS toggle that, once granted, opens nearly everything on a Mac that isn't owned by the root user — documents, browser history, cookies, mail, and chat logs among them, per Wardle's description to Ars Technica. For a conventional app, that access is usually tied to one narrow function, like a backup tool. For an AI agent designed to act on a user's behalf across email, calendars, messaging, and shopping, the same permission becomes a single point of entry to nearly all personal data on the machine — which is the scenario Apple's statement points to directly.

What should Mac users watch for next?

• Whether Apple's updated permission flow requires separate, more specific prompts before an app can read Messages, Mail, or browsing history, rather than one blanket Full Disk Access grant.
• Whether Meta or other AI agent developers change how their Mac apps request or describe Full Disk Access following Apple's statement.
• Whether Apple publishes developer guidance clarifying what AI agents can and cannot do once a user grants system-level access.
• Whether other AI assistant makers face similar scrutiny over opt-in disclosures tied to broad OS permissions.

Glossary

• Full Disk Access (FDA): A macOS system-level permission that lets an application read nearly all files on a Mac not restricted to the root user, including messages, mail, and browsing history.
• Connector: An in-app setting, separate from macOS permissions, that a developer uses to turn on a specific data integration — in this case, Muse's link to Apple Messages.
• AI agent: Software designed to act autonomously on a user's behalf across apps and data sources, as opposed to a tool that performs a single task on command.

For a Bay Area-baked gift, Stirred, Not Shaken ships in the U.S.