Apple has announced tightened controls for full disk access in macOS, given the risks posed by ever-evolving AI agents.
Apple introduced full disk access in macOS Mojave (10.14) to give users control over application access to the entire system. The function can be switched on or off Apple Menu > System Preferences > Privacy & Security.
By default, macOS restricts applications’ access to system-protected areas and sensitive user data. Giving an application full disk access removes this protection, allowing the software to read or modify private files, including a user’s email, messages, and browsing history.
Improperly managed full disk access permissions can result in malicious applications gaining access to sensitive information. Apple is now planning stricter controls as AI agents and modern applications increasingly request full disk access.
According to Apple, some applications use full disk access in a way that could endanger users by exposing their files, emails, messages and browsing history without users’ full knowledge and understanding.
“For communication apps, this can also jeopardize the privacy of the people with whom users communicate,” Apple says said on Friday.
Citing the risks posed by more powerful AI agents, the company will introduce additional controls to ensure that applications only gain this level of access with explicit consent from users.
“As AI agents become more powerful and autonomous, the risks associated with this level of access will increase significantly. We are committed to ensuring that users clearly understand these risks before granting such access so that they can make informed decisions about their own data and privacy,” Apple said.
The company did not specify when the additional controls would be implemented, nor did it specify the exact trigger for the implementation of these controls.
Two weeks ago, technology journalist Jason Aten revealed that Meta’s personal assistant Muse accessed his private iMessages even though he believed full disk access was disabled. Meta leaders controversial the claim that both full disk access and a message connector must be explicitly enabled.
Related: Social engineering detection penetrates the live conversation
Related: Google restricts open source bug bounty amid wave of invalid automated reports
Related: AI agents targeted US and Canadian government sites for SQL injection
Related: Hacker Talks: Rob Juncker, a knock on the door and a moral compass
