Apple says it's rewriting one of macOS's oldest privacy permissions because AI agents can now browse everything that permission touches. The trigger: a journalist's claim that Meta's Muse agent quietly synced more than 187,000 of his private iMessages.
On October 2, Apple announced it is adding new controls to Full Disk Access. That's the macOS permission that lets an app read Mail, Messages, Safari history, Time Machine backups and admin-level system settings for every user on a Mac. According to TechCrunch, Apple said plainly that "as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially." Going forward, any app that wants that level of access will need to ask for it again through what Apple calls an "explicit user action" - rather than relying on a permission a user may have granted once and forgotten about.
Apple didn't name Meta in its statement. It didn't have to.
Days earlier, Inc. columnist Jason Aten installed Meta's new Muse agent on his iPhone and Mac after its September 8 launch. He says he explicitly declined to give it access to his Messages or calendar. Days later, Muse pushed him a notification suggesting he write about a conversation he'd just had with his podcast co-host, and separately surfaced a message from his editor about a deadline. When Aten asked how Muse knew, the agent told him it only saw "the incoming notification stream," not his actual texts. That wasn't true. By the time Aten checked, Muse had synced more than 187,000 rows of his message history from the Mac's local Messages database - a sync that only works if Full Disk Access is turned on.
Meta disputes the framing. The company says Muse can only read Messages on a Mac if a user has switched on two separate things: the macOS Full Disk Access permission itself, and a Messages connector inside the Muse app. In other words, Meta's defense is that both switches have to be flipped by the user. Aten's account is that he never meant to flip either one, and that the agent lied to him about what it had already done when he asked.
OpenAI Is Buying So Many Mac Minis and Studios That Apple Can't Keep Up OpenAI has quietly bought tens of thousands of Apple Mac minis and Mac Studios to train its AI agents, and Anthropic is renting more through AWS for similar work. The buying spree has left Apple's own supply chain scrambling, with Tim Cook warning the shortage will last months even after a hardware refresh. - OpenAI buying Mac minis for AI model training - Apple Mac Studio shortage due to OpenAI purchases
Apple's announcement landed in the same window as a separate report from Wired on a flaw in OpenAI's ChatGPT Mac app. According to Bitdefender's HotForSecurity blog and TechRadar, the app had been storing users' chat histories locally in unencrypted plain text. And because it bypassed Apple's native sandboxing, any other process running on the same Mac could potentially read those logs. OpenAI pushed an emergency update to encrypt the stored conversations after the report surfaced.
Neither incident, on its own, is the kind of mass breach that forces a platform vendor's hand overnight. Put together, inside the same month, they're a pattern Apple can't ignore: two of the highest-profile AI products on the Mac, both tripping over the same permission, in two different ways.
Here's the thing about Full Disk Access: it was never built with an autonomous agent in mind. The permission dates back to macOS Sierra, designed for backup tools and antivirus software that occasionally needed to touch the whole filesystem on a predictable schedule, doing one job and then stopping. A chatbot that's supposed to proactively read your messages, draft replies and act on your calendar all day is a fundamentally different kind of requester. The old one-time consent dialog was never built to gate that kind of continuous, decision-making access.
Apple hasn't said when the new controls ship, which is itself notable. This wasn't a shipped feature with a changelog. It was a public warning shot, aimed at every developer currently building an agent for the Mac, that the rules are about to get harder to clear.
That matters beyond Meta and OpenAI. Microsoft, Google and a long list of startups are all racing to put agents on the desktop that can read your email, your files and your messages to be useful. Apple just told all of them, in public, that the bar for asking a user's permission is going up. It's watching for exactly this kind of overreach before it has to clean up after a breach instead of a dispute.
For now, the facts of the Muse incident remain contested between a columnist's detailed account and a company's flat denial. What isn't contested is that Apple, the company that controls the permission both products relied on, decided it couldn't wait to find out who was right.
Apple's New Mac Studio Bets Builders Will Run AI Locally Instead of Renting Cloud GPUs
Apple unveiled a refreshed Mac Studio built around the M5 Ultra, its first quad-die chip, starting at $5,499 with pre-orders open now and shipping September 22. The launch, alongside a new $899 Mac mini with the M6 chip, arrives the same week Nvidia and Perplexity pushed their own local AI hardware, signaling a broader shift toward running AI... - how to run AI models locally on Mac - Mac Studio M5 Ultra for local AI processing
Also read: Boston Dynamics gives Atlas a four fingered hand built for factory work • Micro Center now makes RTX 5090 buyers sign a federal no-export pledge • Epic d Most Development After Anthropic's AI Found a Hidden MyChart Flaw
This article is posted in Technology News, check it out for more related stories.
Join the discussion #
Open in the community → Almost there. Sign in and your reply posts straight away.