Updated:
Apple said on Friday, October 2, that it will add controls to macOS to make users more explicitly approve apps seeking Full Disk Access, a permission that can expose files, email, messages and browsing history. The announcement followed complaints that Meta’s Muse AI assistant had referenced private messages on a user’s Mac, though Meta disputes that the app accessed messages without required permissions.
Apple did not name Meta or Muse in its announcement, and it has not given a timetable for the changes. The move addresses a broader concern about desktop AI agents: they can be useful when given access to personal information, but that same access may expose sensitive data if users do not understand what they are approving.
Apple says the permission needs clearer safeguards
Full Disk Access largely bypasses macOS privacy controls, Apple said in a post for developers. The setting was created to support functions such as backup software, which may need to read data across a computer, but Apple warned that some developers use the permission in ways that may put users at risk.
The company said it plans additional controls so that users who choose to grant this level of access must take “very explicit” action. It did not describe the interface, say whether the change will apply to all apps with Full Disk Access, or identify a release date.
Apple also highlighted risks beyond the account holder’s own data. If an app can access messages, it may also expose the communications of people who have written to the user, the company said. The announcement signals that Apple sees broad access as a privacy issue with consequences for contacts as well as device owners.
Meta contests the account of Muse’s access
The dispute began after Inc. technology columnist Jason Aten reported that Muse suggested an article topic based on a private Messages conversation. Aten said he had not granted the assistant permission to read message histories. He reported that Muse told him it had been relaying notifications, while he later found evidence that it was syncing a local Messages database.
Meta has said the Messages integration is opt-in and requires users to grant Full Disk Access in macOS and enable a separate Messages connector in Muse. The company’s representatives argued that Muse cannot read message content unless those permissions are granted. Meta disputed Aten’s description of what happened; the competing accounts have not been independently resolved in the available reporting.
The distinction matters because Full Disk Access is a system-level permission, while a connector is an app-level setting. Apple’s planned changes may make the system-level decision more conspicuous, but its announcement does not explain whether it will alter how individual AI apps request access or how those apps communicate the scope of their permissions.
Desktop agents depend on access to personal data
Unlike the default app-sandboxing model on Apple’s iPhones and iPads, Macs allow users to grant certain apps broader access to device data. Apple said Full Disk Access can expose files, mail, messages and browsing history, a wide range of material that makes the setting useful for some software and potentially consequential when granted to other applications.
AI agents are designed to carry out tasks using information and services a person makes available to them. Reuters reported that Muse can perform tasks such as canceling subscriptions or seeking better prices. When an agent can read personal records or interact with accounts, permission choices become central to both its usefulness and the user’s control over private information.
Apple’s announcement referred to AI agents becoming more capable and autonomous, but did not single out a particular product or say the planned controls would be limited to AI software. The change is therefore framed as a wider update to how macOS handles an unusually broad permission, against a backdrop of new AI applications seeking deeper access to users’ computers.
Timing and implementation remain unclear
Apple said the safeguards are coming but did not provide a schedule or technical details. Until it publishes those details, users and developers do not know whether the changes will involve new warning screens, extra confirmation steps, limits on existing permissions, or some combination of measures.
Meta’s response to the Muse complaint centers on its claim that users must approve both macOS Full Disk Access and the app’s Messages connector. Apple’s statement does not determine whether Muse had either permission on Aten’s device, and it does not announce an investigation into the incident. The specific allegations remain disputed.
For now, the concrete development is Apple’s stated plan to make granting Full Disk Access more deliberate. The next milestones are Apple’s eventual release of the controls and its explanation of how they will work; neither was specified in the October 2 announcement.
