Apple changes full-disk access permissions to curb abuse from AI agents

Apple said it is changing its macOS privacy settings to stop third-party app developers from misusing them to access message histories. The announcement, made Friday, comes two weeks after tech columnist Jason Aten said Meta's general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permission to read his messages and had assumed they were off-limits.

Meta CTO David Singleton disputed that account, saying the Messages integration in the Muse Mac app is opt-in. "Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled," he said. macOS security expert Patrick Wardle questioned that denial, telling Ars Technica that with Full Disk Access, any non-root file is readable, including browsing history, browser cookies and chats. Meta PR responded to questions only by requoting Singleton.

Apple, explaining its change to the Full Disk Access permission, said some developers are using it in ways that could put users at risk, exposing everything on their systems, including files, mail, messages and browsing history, without users' full knowledge and understanding. Apple said that for communication apps this can compromise the privacy of the people users are communicating with, and that as AI agents become more capable and autonomous, the risks associated with this level of access will grow substantially. Apple did not name Meta, Muse or any other app or developer.

The announcement came 11 days after Wardle disclosed a Muse configuration that allowed any app or code running on a Mac, including commands injected through ClickFix attacks, to take full control of the AI assistant. It also followed Amazon blocking Muse from its platform; Amazon said all such apps "should operate openly and respect service provider decisions about whether or not to participate." Meta PR did not respond to questions sent Friday.