If you’ve been using third-party apps on your Mac, you are probably familiar with a permission dialog box called “Full Disk Access.” It’s sort of a big catch-all permission that lets an application read or write almost any data to your Mac’s drive. It was originally conceived as a way for apps to be able to fully back up and restore your hard drive, but developers have since used it as a shortcut for auto-updating apps, managment apps, among others. On my Mac, the Adobe Creative Cloud updater wants this permission, as does the Logitech software for managing my keyboard and mouse, and Microsoft OneDrive.
AI agents on the Mac also typically ask for this permission, and it allows them to access information that you may not iwant them to have. If you know where the data is stored, you can access full messages, contacts, photos, emails, browsing history, and much more with just this one setting.
In a note on its Developer Site, Apple says it’s about to crack down on this Full Disk Access abuse by introducing additional controls:
We give developers powerful APIs to build incredible capabilities into their apps for Apple products, backed by a set of controls designed to protect users’ private data. Full Disk Access largely sidesteps these controls in order to allow backup apps to function properly on the Mac. Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.
Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action. Addressing this is critical. As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially. We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.
Apple has not yet said what form these controls will take, but it’s likely that it’ll start with sterner wording for this setting, making it clear that any app that requests this access can essentialy see everything on your drive, including every cache and buffer storing info from online services.
We’re starting to hear plenty of horror stories about AI agents having knowledge they’re not supposed to have or wreaking havoc by deleting or modifying important files, and they almost always stem from this simple and over-permissive setting granting access to read and write almost every file on your Mac.
Apple has not given a time frame for this Full Disk Access abuse crackdown, but given how many applications (not just AI agents) use it when they don’t really need to access your entire Mac disk, it can’t come soon enough.