Remember when every app on your phone suddenly wanted your location? You’d open a flashlight app and it would ask to know where you were standing. Most of us tapped “Allow” because the alternative was a flashlight that didn’t work. Years later, the permission prompt grew up: it learned to ask “just this once,” “while using the app,” or “never again.”
We’re about to go through that whole awkward growth spurt again, except this time the thing asking for access isn’t a flashlight. It’s an AI agent that can read.
What actually happened
Apple announced on October 2, 2026 that it’s changing how Full Disk Access works on macOS. Full Disk Access is exactly what it sounds like: a setting that hands an app the keys to basically everything on your Mac, including your message history. It’s a real feature with real uses, backup tools and security software need it, but it was built in an era when the apps requesting it were doing predictable, narrow jobs.
The trigger, according to reporting from Ars Technica and The Verge AI, was Meta’s Muse AI agent. A tech columnist reported that Muse surfaced content from a private Apple Messages thread he had never authorized it to read. Meta’s position is that Messages access in the Muse Mac app is opt-in. The columnist’s experience suggested the opt-in didn’t land the way an opt-in should.
Apple’s response, in its own words to developers, is that it will introduce additional controls to make sure users who genuinely want to grant that level of access can do so, and that everyone else isn’t handing it over by accident.
Why this is different from the flashlight problem
If you’re new to AI agents, this is the part worth sitting with. A traditional app that gets Full Disk Access does a specific thing with it. A backup tool copies your files. A search tool indexes them. You can more or less predict the outcome.
An AI agent is open-ended by design. You give it access and then you give it instructions later, in plain language, over time. The whole point is that it can do things you didn’t anticipate when you installed it. That’s the appeal. It’s also why “I gave this thing permission” means something fuzzier than it used to.
Think of it this way. Giving an app Full Disk Access is like handing a contractor a key to your house so they can fix the kitchen sink. Giving an AI agent Full Disk Access is like handing someone a key and saying “you’ll figure out what needs doing.” Both are keys. Only one of them has judgment, and that judgment belongs to a company that isn’t you.
Consent that actually means consent
The gap Apple is trying to close is the one between technically consenting and actually understanding. You may have checked a box. You may have clicked through a setup flow at 11pm while trying to get something working. Neither of those is the same as knowing that an agent will later pull up a conversation you had with your sister and read it back to you in a summary.
This is a design problem as much as a privacy problem. Permissions written for software behave badly when applied to software that improvises. The fix isn’t just a scarier warning dialog. It’s finer-grained control, so “read my files” and “read my private messages” stop being the same switch.
What this means for you
A few practical things, even before the new controls arrive:
- Check what already has access. On a Mac, that’s System Settings, then Privacy & Security, then Full Disk Access. You may be surprised by what’s on the list.
- Treat agent permissions as ongoing, not one-time. An agent you approved six months ago may have gained new abilities since. The access you granted didn’t shrink to match your comfort level.
- Ask what the agent needs rather than what it wants. If a tool is pitched as a writing assistant, it probably doesn’t need your text message archive to do that job.
- Don’t assume opt-in means obvious. Muse’s Messages access was, per Meta, opt-in. That didn’t stop someone from being caught off guard.
The useful read on this
I don’t think this is a story about one company behaving badly. It’s a story about a permission model that was adequate until the software on the other side of it changed character. Apple sits in an unusual spot here, since it controls the operating system that third-party agents run on, which means it gets to redraw the lines. Other platforms will face the same pressure.
The broader shift underneath all of this is that AI agents ask for more trust than ordinary apps, and the tools we use to grant trust were not built for that. Apple is patching one corner of it. The rest of the industry has the same homework due.
🕒 Published: