Apple just drew a brighter line around one of macOS's most powerful privacy switches. In an October 2 developer note titled Updates to Full Disk Access in macOS, the company said it will add controls so apps only get that "extraordinary" reach after "very explicit user action." The reason Apple gives is blunt: AI agents make Full Disk Access riskier as they get more autonomous.
If you have been watching Muse, ChatGPT's Mac app, and the broader agent permission fight, this is the operating-system answer those stories were pointing at. Here is what Apple actually promised, how we got here in a few weeks, and what you should check on your Mac today.
What Full Disk Access actually unlocks
Apple built Full Disk Access so backup tools could see past the normal privacy gates. Grant it, and an app can reach files, Mail, Messages, and browsing history that sandboxed apps never see. That was always a sharp tool. Apple now says some developers are using it in ways users do not fully understand, and that communication apps can even expose the privacy of people on the other end of a thread.
The company is not shipping a finished UI change in that note. It is announcing a direction: more friction and clearer consent before an agent (or any app) gets the keys. Apple did not name Meta, OpenAI, or any other vendor in the post.
How the last three weeks lined up
| When | What happened | Why it matters for FDA |
|---|---|---|
| ~mid to late Sept 2026 | Inc. columnist Jason Aten said Muse referenced a Messages thread he did not think he had opened to the agent | Public fight over whether users understand what Full Disk Access really grants |
| ~11 days before Apple's note | Security researcher Patrick Wardle disclosed a Muse config that let other local code hijack the agent's privileges | FDA is not just a consent checkbox; it widens the blast radius of a compromised agent |
| Recent weeks | Amazon blocked Muse from its platform over participation rules; Wired covered a ChatGPT Mac-app flaw risking sensitive data | Shows the agent permission problem is not a one-app story |
| Oct 2, 2026 | Apple publishes the Full Disk Access update for developers | OS vendor steps in with stricter consent language aimed at AI agents |
Meta CTO David Singleton told reporters Muse only reads Messages when both macOS Full Disk Access and Muse's Messages connector are on. Ars Technica's Dan Goodin pressed that point with Wardle, who noted that FDA already makes Messages-readable data available to any privileged app. Apple's wording, that some developers expose mail and messages without users' full understanding, lands closer to the critic side of that argument even though Apple never names Muse.
What you should do on your Mac
Open System Settings → Privacy & Security → Full Disk Access and look at every app on the list. If an AI agent is there and you only wanted calendar or a single folder, turn it off until you have a concrete reason to leave it on. Prefer agents that ask for narrower permissions (specific folders, explicit connectors) over ones that treat FDA as the default on-ramp.
Apple has not published a ship date for the new consent UI in that developer note. Until it lands, the work is still yours: revoke what you do not need, and assume any app with FDA can see more than the marketing copy suggests.
Geeknewz verdict
Geeknewz's view: this is the right OS move, and it should have been earlier. Desktop agents only work if they can see your stuff, but Full Disk Access was never designed as an AI product surface. If you run Muse, ChatGPT, or any other Mac agent, audit FDA now rather than waiting for Apple's tighter prompt. Developers who need broad disk access for backups should keep it. Everyone else should treat FDA like root: useful, rare, and never granted because an install wizard looked friendly.
Source: Apple Developer News; reporting from TechCrunch and Ars Technica.