Meta says full disk access in the Muse Mac app is opt-in. A tech columnist says Muse surfaced content from a private Messages thread he never authorized it to read. Both of those things can be true at once, and that gap is exactly why Apple spent October 2 publishing a developer note about tightening full disk access in macOS.
I review agent toolkits for a living, which means I spend a lot of time clicking through permission dialogs that nobody reads carefully, including me on a bad day. Full disk access is the one I always flag. It is not a feature toggle. It is a master key. And for the past couple of years, the default posture of nearly every desktop AI agent has been to ask for it early, explain it vaguely, and hope you say yes.
What Apple is actually changing
Per Apple’s developer post and reporting from The Verge AI and Ars Technica, Apple is adding new controls so that users explicitly grant this level of access, rather than handing it over as a side effect of setup. Apple frames it as stopping third-party developers from misusing the privilege to reach message histories and other private data. Apple’s language points to additional controls for users who genuinely intend to grant that access.
That phrasing matters more than it looks. The problem was never that macOS lacked a permission gate. The gate exists. The problem is that the gate was built for a different era of software, when the apps asking for whole-disk visibility were backup tools, antivirus suites, and developer utilities. Those apps wanted your files. They did not then summarize them, index them, or pipe snippets into a chat window where they could resurface weeks later in a context you never anticipated.
Why agents break the old permission model
Here is the structural issue I keep running into when testing these tools. Traditional permissions answer the question “can this app read this data.” Agents introduce a second question that no dialog box currently asks: “what will it do with the data after it reads it.”
Granting a backup tool disk access has a predictable outcome. Granting an agent disk access has an outcome shaped by whatever prompt someone types six weeks later. The permission is static. The behavior is not. That mismatch is how you end up with a columnist seeing his own private conversation quoted back at him by software he technically authorized.
It also makes “opt-in” a weaker defense than it sounds. Opt-in tells you a human clicked a button. It does not tell you that human understood they were consenting to an open-ended reading of their message history for any future purpose the product team dreams up. Consent to access is not consent to use, and agent products have been collapsing those two ideas into one checkbox.
What this means if you build or buy agent tools
Short term, expect friction. Some of the desktop agents I have tested lean on full disk access to do their most impressive demos: pulling context from across your files, your notes, your chats, and stitching it into something useful. Tighter controls will make those demos harder to pull off out of the box. A few products will feel noticeably less magical.
I think that is a fair trade. A few things worth watching as this lands:
- Scoped access beats total access. Tools that ask for specific folders, specific apps, or specific time windows will age better than tools built on an all-or-nothing grant.
- Explain the use, not just the permission. The best onboarding flows I have seen tell you what the agent will read, when, and what happens to it afterward. Most do not come close.
- Local versus remote processing. “The agent can read your messages” and “your messages leave your machine” are different claims. Vendors should state both plainly.
- Revocation that actually works. Pulling access should also mean previously ingested content stops showing up in results. Nobody advertises this. Ask anyway.
My read on it
This is Apple doing platform work that the agent industry declined to do for itself. The pattern is familiar from the mobile era, where location and contacts access got progressively locked down only after enough apps abused the loose version. Agents are now on that same track, just faster, because the consequences are more legible. Nobody feels a background location ping. Everybody feels a private conversation being read aloud.
If you ship an agent that touches local data, treat this as the floor rather than the ceiling. The products that survive the next round of platform tightening will be the ones that already asked for less than they could get away with, and said clearly why they needed it. The ones treating a single permission grant as a blanket license to read everything forever are going to keep running into walls, and they will have earned every one.
đź•’ Published: