Apple is revising full-disk access permissions on its Mac platform in a bid to curb a growing class of privacy and security risks tied to AI agents, according to people familiar with the matter and industry discussions around the change. The move reflects a broader concern inside the technology sector: as AI systems become more autonomous, the traditional permission model built for human-operated software is increasingly strained.
Privacy Guardrails
Full-disk access is one of the most sensitive permissions in macOS, allowing software to inspect large portions of a device's storage, including messages, files, backups and other personal data. Historically, the control has been used to support legitimate functions such as backup tools, security software and enterprise device management. But the rise of AI agents — systems designed to read, summarize, search and sometimes act across applications — has created a new incentive structure for abuse.
The core issue is not simply whether an AI assistant can be trusted in the abstract. It is whether the software stack beneath it can reliably distinguish between a user's intent and an agent's expanding reach. If an AI tool is granted broad disk-level access, it may be able to ingest far more data than a user reasonably expects, including private messages or sensitive documents that were never meant to be exposed to model training, inference or third-party processing.
Apple's response underscores a familiar pattern in its product strategy: limit default access, force explicit user consent and narrow the scope of what developers can do unless there is a compelling, verifiable reason. That approach has long set Apple apart from rivals that have favored broader platform openness in exchange for faster feature development. In this case, the company appears to be drawing a sharper line around the boundary between a helpful assistant and a privileged system tool.
AI Access Debate
The timing is notable because the industry is moving in the opposite direction. Major technology companies are racing to make AI agents more capable, more persistent and more deeply integrated into operating systems, browsers and productivity suites. That ambition depends on access: to calendars, email, documents, chat histories and other personal data that give the agent context. But the more context an agent receives, the greater the risk that it can be misused, over-collect data or expose information through poor safeguards.
The debate has sharpened around whether existing compliance frameworks and app permissions are enough. Some companies argue that standard privacy disclosures, enterprise controls and user consent flows can manage the risk. Apple appears to be signaling that those measures are not sufficient when software can autonomously traverse a device and aggregate sensitive material at scale. In practical terms, the company is treating AI agents less like conventional apps and more like privileged operators that require a stricter security model.
That stance may frustrate developers building advanced assistants for the Mac, especially those that rely on broad local access to deliver features such as message summarization, document search or cross-app automation. It could also complicate enterprise deployments, where IT teams often want powerful tools that can operate across a user's environment. Yet Apple's calculus is likely shaped by reputational risk as much as technical risk. A single high-profile misuse of message access or file scraping could quickly become a platform-wide trust problem.
Platform Control Stakes
The change also fits into a larger contest over who sets the rules for the AI era. If AI agents become the primary interface to computing, then operating-system vendors will control not just hardware and software distribution, but the permissions architecture that determines what agents can see and do. That makes access policy a strategic lever, not merely a technical detail.
For Apple, tighter full-disk access rules reinforce its broader message that privacy is a product feature and a competitive differentiator. For the wider industry, the move is a warning that the next phase of AI adoption will not be defined only by model quality or benchmark performance. It will also be shaped by how much trust platform owners are willing to extend to software that acts with increasing independence.
The immediate effect is likely to be friction for some developers and a more cautious rollout of agentic features on macOS. The longer-term effect may be more consequential: Apple is helping define the baseline expectation that AI tools should earn access incrementally, not assume it by default. In a market where the appetite for automation is rising faster than the comfort level with surveillance, that distinction could prove decisive.