Apple changes full-disk access permissions to curb abuse from AI agents

Apple said it will modify macOS privacy settings to prevent third-party developers from abusing system permissions to read users’ message histories. The company announced the change on Friday, citing concerns that some apps could use powerful permissions in ways users do not expect. The announcement followed a report by columnist Jason Aten, who said Meta’s Muse sent him an unsolicited notification that referenced a private Apple Messages thread between him and a co-worker. Aten said he had not granted Muse permission to read his messages and had assumed those conversations were off-limits. The post sparked widespread discussion on social media about the risks posed by AI assistants with access to calendars, emails, messages and other personal data. Meta’s technical lead David Singleton responded by saying Muse’s Messages integration is opt-in: a user must both grant macOS system-level Full Disk Access and enable a Messages connector within Muse for the agent to read Messages content. Meta’s public relations team later reiterated that explanation when asked how Muse could access Messages if Full Disk Access was granted to the app. Not everyone agreed with Meta’s characterization. macOS security researcher Patrick Wardle told the reporter that, from a technical perspective, Full Disk Access can permit reading of many non-root files — including chats, browser histories and cookies — which raised questions about how system-level permissions are managed and whether they can be constrained to prevent unintended data access. Apple’s stated changes aim to tighten those controls and reduce the potential for AI agents or other third-party apps to leverage broad system privileges to access message data without clear, intentional user consent. The episode has brought greater attention to how operating system permissions intersect with AI features and user expectations of privacy.