What the Full Disk Access grant actually covers

On macOS, Full Disk Access is one of the broadest permissions a person can hand to an app. Apple says the setting “largely sidesteps” the privacy controls it builds into the system, and that it exists so backup apps can read the files they need. Once granted, an app can read protected locations that are otherwise closed to it. Apple names the categories itself: files, mail, messages and browsing history. macOS records who holds what through Transparency, Consent and Control (TCC), the framework behind every privacy prompt.

The shape of the permission is the part worth holding onto. Most macOS prompts are narrow. A camera prompt covers the camera. A contacts prompt covers contacts. A file prompt covers the file you choose. Full Disk Access is not a larger version of those. It removes the per-resource checks for one app, so whatever that app can reach, it can read.

Why an agent holding it differs from a backup app

Apple’s own framing is that the permission exists “to allow backup apps to function properly.” A backup app runs a predictable job: read files, write copies. It takes no instructions from the data it touches.

An AI agent, software that acts on your behalf across apps, takes instructions from the content it processes. Meta’s Muse, the company’s desktop AI assistant, shows what that difference looks like in practice: security researcher Patrick Wardle disclosed a 0-day in it in September, as reported by Ars Technica. An undocumented setting let any locally installed app, or any code able to run, change where Muse sent audio for transcription. Point that endpoint at an attacker and the account token follows. Wardle’s summary: “We can manipulate the agent and leverage its privileges to do whatever we want.” He contrasted it with writing “a very comprehensive Mac malware stealer.” With an agent already in place, an attacker can instead “leverage the AI assistant itself.”

The delivery path mattered as much as the bug. Ars called it “a simple variation of ClickFix attack,” a technique that tricks people into running code themselves. A backup app with Full Disk Access is a read surface. An agent with the same grant is a read surface plus an execution path, and the two compose. Compromise the agent, inherit its reach. Meta shipped a hotfix more than 12 hours after Wardle’s disclosure, Ars reported.

What Apple said, and what its post does not say

Apple’s developer post, “Updates to Full Disk Access in macOS”, is dated October 2, 2026. Two phrases carry the substance. Apple said it “will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action.” It tied the change to AI directly: “As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.”

The post’s absences are as informative as its sentences. Apple names no app, developer or company. It gives no date, no macOS version and no release channel. It describes no interface for the new controls, leaving “additional controls” and “very explicit user action” as the only descriptors. It never uses block, limit or remove.

That last point matters because the change has been described as Apple limiting the permission. TechCrunch printed a correction on exactly that: the change “reflects informed consent, but is not a new limit.” Stronger consent is the accurate frame. The proposal makes the grant harder to give by accident; it does not take the grant away. Apple’s statement is verified. When the controls arrive, and in which release, is not.

What the Muse episode shows, label by label

Meta’s Muse is the case that made this concrete, and it needs separating.

Verified: the tech columnist Jason Aten said Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages, and that he had not granted Muse permission to read his messages. Aten’s original column was not available to us, so his account here comes from Ars Technica’s and TechCrunch’s reports.

Verified: two Meta executives posted rebuttals. Meta executive David Singleton wrote on Threads: “The Messages integration in the Muse Mac App is opt-in. Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled.” Meta communications executive Andy Stone posted a separate rebuttal on X to the same effect, adding that access “can be revoked at any time.” Also verified: when Ars asked Meta how Muse could fail to read messages when the app held Full Disk Access, Meta PR requoted Singleton instead of answering, and did not reply to follow-up questions.

Contested: whether Muse could read Messages content with the Muse Messages connector off while Full Disk Access was on. Meta says no. Wardle says the permission alone exposes any non-root file, naming “browsing history, browser cookies, chats.” Public evidence does not settle it. TechCrunch reported that Aten had not granted Full Disk Access at all, so the configuration behind his notification is disputed too. The dispute concerns the Muse Messages connector and says nothing about WhatsApp or other direct-message accounts.

Verified, and separate from the Messages question: Amazon began blocking people from using Muse to shop on its site about 12 hours before Wardle’s disclosure, calling Muse an “unauthorized AI agent [that] violates Amazon’s Conditions of Use.” The block concerns shopping, a separate capability from the Messages connector.

Unconfirmed: that Apple aimed the change at Muse. Apple names nobody, and no source documents a link. Ars noted that the timing “makes the possibility likely” while accepting that the statement might not “have been referring to the Muse incident.”

What to check on one work Mac

If you run an assistant on a work Mac, the check is short. Open System Settings, choose Privacy & Security, and find the Full Disk Access section. Apple documents per-app file access under Privacy & Security > Files & Folders; the Full Disk Access list lives in the same area. What you want is the list of apps holding the grant, and whether you recognise each one.

Two questions per entry: did I grant this, and does it need all of it? A backup tool doing its job is one case. A chat client, a launcher or an agent that reads your notes is another. A grant you cannot explain is worth revoking until you know why it is there.

What is still open

Apple has not said when the controls arrive, which macOS release carries them, or whether backup apps, endpoint security tools and other long-standing holders keep a simpler path. Its rationale suggests they might, but the post does not exempt them. For managed fleets, Apple has not said how a “very explicit user action” requirement interacts with admin-deployed privacy profiles. Apple’s September deployment guide lists pre-settable consent for camera, microphone, location and other services, and Full Disk Access is not on that list.

As of October 2, Ars reported “no known reports” of other apps abusing the permission to read messages and browsing history. That is the strongest statement the public record supports, not proof that no other app has done this.