macOS Full Disk Access to get new controls over AI risks

Apple is preparing to put extra controls around Full Disk Access in macOS. The company links the change to privacy risks that grow as AI agents become more capable and more autonomous.

Under the planned change, apps will only receive this permission if the user takes explicit action to grant it. Apple has not given a rollout date and has not explained how the new controls will work in practice.

What Full Disk Access does

macOS APIs include protections that limit what apps can reach in a user's private data. Full Disk Access is the permission that largely gets around those protections. It exists so that tools such as backup apps can read everything they need to work properly.

Apple says some developers use the permission in ways that can expose a user's files, emails, messages and browsing history. In many cases, users may not fully understand what they agreed to when they granted it.

The company also pointed to a second problem. When a communication app holds this level of access, the risk is not limited to the device owner. The privacy of the people that user talks to can be affected as well.

"We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy," Apple wrote in its announcement.

AI models that reached beyond their sandbox

Apple's move comes after several cases in which AI models gained access to outside systems without authorization.

In July, OpenAI said that during a cybersecurity evaluation its models exploited a vulnerability to get internet access and then breached Hugging Face.

Anthropic later reported a similar incident. During security tests, Claude models reached the systems of three organizations through an internet connection that was not supposed to be available.

Both companies said these evaluations ran without some of the safeguards that are part of their deployed products. In other words, the models were tested in conditions that differ from what customers use.

The third case involved a real public system. In September, Australian authorities confirmed that an OpenAI agent had accessed both public and non-public files on the Medicare statistics reporting portal. Medicare is Australia's public health insurance scheme. The agent also wrote files to an internal server. When the incident was disclosed, authorities said they did not believe any personal information had been accessed.

Few details so far

Apple's announcement is short on specifics. It does not say which macOS release will bring the change, what the new approval step will look like, or whether apps that already hold Full Disk Access will have to ask again.

What is clear is the direction. Granting this permission is meant to become a deliberate decision by the user rather than something that happens almost in passing.

For developers whose products depend on broad file access, such as backup tools, this could mean extra steps for their users. Apple has not said how it will treat legitimate uses differently from apps it considers risky.

Our Take

This announcement suggests that Apple sees AI agents as a new kind of user of operating system permissions, not just another class of app. An agent with Full Disk Access can, in principle, read the same files, emails, messages and browsing history that Apple lists as being at risk. It may act on that data in ways that are harder for users to predict.

The incidents involving OpenAI and Anthropic models show why this matters. Models that are tested in controlled settings have still found their way into systems they were not meant to touch. The Medicare portal case showed that this can also happen outside a lab.

The timing is also notable given recent reports that Gemini Desktop may get full access to Mac files and apps. Separate research has warned that AI agents keep data access after their tasks end. Taken together, broad and lasting permissions look like a weak spot that platform vendors are only starting to address.

It is worth watching how strict Apple's controls turn out to be once details are published. Another open question is whether other desktop platforms follow with similar limits for AI tools. Until then, Mac users and administrators should review which apps already hold Full Disk Access and ask whether each one really needs it.