Apple Narrows Disk Access as AI Agents Reach for Your Data

Apple is tightening how Full-Disk Access works on macOS to stop AI agents from quietly reading sensitive files such as messages, Ars Technica reports. The change follows disputes over what that permission should actually grant, and it lands squarely on a tension the industry has been avoiding: AI assistants are most useful when they can see everything, and that is precisely the problem.

Full-Disk Access was designed as a blunt instrument. An app either gets sweeping read access to protected data or it does not. That model was tolerable when the apps requesting it were backup tools and antivirus scanners. It becomes dangerous when the requester is an autonomous agent that acts on your behalf, pulls context from your messages and mail, and sends it to a model running in someone else's data center.

Key points

• Apple is restricting Full-Disk Access specifically to curb AI agents reading messages and other sensitive data
• The permission was all-or-nothing, which suits backup tools but not autonomous assistants
• Third parties including Meta want broad system access that Apple's privacy model resists
• The change reframes a platform fight over who controls the context AI tools can consume

The flow of data that Apple is trying to interrupt looks like this:

User grants Full-Disk Access
          │
          ↓
   AI agent reads files      ← messages, mail, local docs
          │
   ┌──────┴──────┐
   on-device        cloud model
   │               │
   ↓               ↓
 stays local    leaves the machine  ← Apple's concern

The subtext is competitive. Apple controls the operating system, and it has an interest in being the one assistant with privileged access while rivals negotiate for scraps. When Ars Technica notes that parties like Meta want the broad access Apple is now fencing off, that is not incidental. Permissions are policy, and policy written by a platform owner tends to favor the platform owner.

Still, the privacy case is real on its own terms. An agent that can read your entire disk is a single compromised credential away from exfiltrating your life. Hard limits on what automated software can touch are overdue, and the same instinct shows up elsewhere in the discourse: a widely shared argument this week called for default hard budget caps on AI APIs and cloud services, on the theory that automated systems spiral without enforced ceilings. Access and spend are two faces of the same worry. Autonomous software does what it is permitted to do, relentlessly, so the permissions had better be narrow.

The open question is whether narrowing access at the OS level actually protects users or merely reshuffles which company gets to be the trusted intermediary. Apple frames this as privacy. It is also a bid to decide the terms on which every other AI product reaches your data. Both things can be true, and for now they are.