Apple has announced changes to the control system for Full Disk Access in macOS, introducing additional controls to ensure that users who genuinely wish to grant a specific application such a high level of access can do so, but only through a very explicit and deliberate action. The company stressed that resolving this issue is critical, as the risks associated with this level of access are growing alongside the increasing capabilities and autonomy of AI agents.
The incident that sparked the debate occurred about two weeks ago, when the technology columnist reported that Met's AI agent, Muse, had sent a notification referencing a private conversation held with a colleague via the Apple Messages app. The columnist highlighted that he had never granted the Muse agent permission to read his messages, and had assumed his messages were out of reach of that agent. The incident sparked a storm on social media.
Apple states that it provides developers with API interfaces for building functionality on its devices, alongside a set of controls designed to protect private data. However, the Full Disk Access setting largely bypasses security controls, allowing backup applications to function correctly. Some developers are using this setting in a way that exposes users to risk by exposing all data on the system, including files, emails, messages, and web browsing history, without the user's full knowledge and understanding.
In messaging applications, full disk access compromises the privacy of the people with whom users are communicating, further amplifying the seriousness of the issue. Apple did not explicitly state that the incident with Muse was the catalyst for the announced changes, but the announcement of stricter access control on macOS followed the incident becoming public.
The new system is designed to ensure that the high level of access is not granted lightly, but only through a conscious and deliberate action by the user. This aims to reduce the risk of situations in which applications, including AI agents, can access sensitive data without explicit consent.
