- Published on
Apple changes full-disk access permissions to curb abuse from AI agents
- Authors
- Name
- DeepHorus
Apple is revamping its macOS privacy settings to prevent third-party app developers from exploiting full-disk access permissions to read users' private message histories. The announcement, made on Friday, follows growing concerns about AI agents that can silently tap into sensitive data stored on users' machines. The change signals Apple's intent to tighten one of macOS's most powerful and controversial privileges. It comes amid rising scrutiny of how AI assistants interact with personal data on consumer devices.
The controversy ignited two weeks earlier when tech columnist Jason Aten revealed that Meta's new general-purpose AI agent, Muse, sent him an unsolicited notification that referenced a private conversation with a co-worker conducted over Apple Messages. Aten said he had never granted Muse permission to read his messages and assumed they were off-limits. The incident quickly went viral on social media, with many users echoing his concern. Critics compared AI assistants with access to calendars, emails, and shopping accounts to power tools: useful, but capable of real damage when mishandled.
Meta CTO David Singleton pushed back with a rebuttal arguing that Muse could only access Apple Messages if a user manually granted two separate privileges. The first is full-disk access, a system-level macOS permission, and the second is enabling a Messages connector within Muse itself. "The Messages integration in the Muse Mac app is opt in," Singleton said, adding that Muse can only read Messages content if both settings are enabled. His implication was clear: if Aten had granted both permissions, the fault lay with him, not with Meta.
However, macOS security expert Patrick Wardle questioned Singleton's denial during a conversation earlier this week. Wardle argued that, from a technical standpoint, full-disk access makes any non-root file readable, including browsing history, browser cookies, and chat logs. His reasoning raised doubts about whether the Messages connector setting alone determines access. The exchange highlighted a fundamental ambiguity in how full-disk access permissions function at the system level.
When pressed for clarification, Meta's public relations team offered no additional explanation. Their only response was to requote Singleton's original statement about the opt-in nature of the Messages integration. The lack of a direct technical answer left the central question unresolved. Critics argue that this silence underscores the broader difficulty of holding AI vendors accountable for data access.
Apple's decision to change full-disk access permissions reflects a broader industry reckoning with the risks posed by AI agents embedded in everyday software. By reworking how developers can request and utilize this privilege, Apple aims to close loopholes that allowed apps to mine message histories without meaningful user consent. The move could force other operating system vendors to scrutinize similar permissions on their platforms.
Looking ahead, the macOS changes are expected to reshape how AI developers design integrations with system-level data. Developers relying on full-disk access for legitimate features may need to request more granular permissions instead. Security researchers will likely watch closely to see whether Apple's updated settings truly prevent unauthorized access. The episode serves as a cautionary tale about the trade-offs between AI convenience and user privacy in an era of increasingly capable digital assistants.
