Apple is preparing to tighten one of macOS's most sensitive privacy permissions, saying the rise of capable AI agents has made broad access to personal data materially riskier. The company said it will add new controls around Full Disk Access, the setting that can allow software to read large portions of a Mac's contents, including files, messages, email, and browsing history, depending on how it is configured and what the user approves.
The warning reflects a broader shift in the technology industry: AI systems are moving from passive chatbots to agentic tools that can take actions on a user's behalf, often across multiple applications and data sources. That evolution has raised fresh concerns among security researchers and platform operators, because the same permissions that make automation useful can also create a wider blast radius if an agent is compromised, misdirected, or simply over-permissioned.
Permission Under Pressure
Full Disk Access has long been treated as a high-trust gate on macOS, reserved for software that genuinely needs deep visibility into a user's system. Apple's decision to revisit the permission underscores how quickly the threat model is changing as AI tools become more autonomous and more deeply integrated into everyday workflows. A tool that can summarize documents, search mail, or draft responses may need broad access to function well, but that same access can expose highly sensitive personal and professional information.
The company's move is also notable because it comes from a platform owner that has built much of its brand around privacy and device security. Apple has repeatedly positioned itself as a gatekeeper that limits unnecessary data collection, and the new controls suggest it sees AI agents as a category that may require stricter oversight than conventional productivity software. The issue is not only whether a user trusts the app itself, but whether the app's underlying model, connected services, or delegated actions could be manipulated in ways that are difficult to detect.
Security experts have increasingly warned that agentic AI changes the calculus for permissions. Traditional software generally performs narrowly defined tasks, but AI agents can interpret prompts, chain actions, and access multiple services in sequence. That flexibility creates efficiency, but it also makes it harder for users to understand exactly what data is being touched and why. In practice, broad permissions can become a hidden dependency for features that appear simple on the surface.
AI Agents Change Risk
Apple's concern arrives as the market races to embed AI assistants into operating systems, browsers, and enterprise tools. The competitive pressure is obvious: vendors want agents that can read context, automate tasks, and reduce friction. Yet the more capable these systems become, the more they resemble privileged intermediaries rather than ordinary apps. That distinction matters because an agent with access to messages, mail, and file systems can infer intimate details about a person's life, work, and relationships even without explicit intent to do so.
The risk is not limited to malicious actors. Poorly designed prompts, unsafe integrations, or model errors can lead an agent to surface information it should not, or to take actions that users did not fully anticipate. In enterprise settings, the stakes are even higher, since a single overbroad permission can expose confidential documents, customer records, or internal communications. Apple's response suggests it believes the operating system itself must do more to mediate those risks rather than relying on users to make perfect judgment calls.
The announcement also highlights a tension at the center of the AI boom: the most useful assistants are often the ones with the most access, but the most secure systems are the ones that limit it. As AI agents become more embedded in daily computing, platform vendors will likely face growing pressure to redesign permissions around context, purpose, and duration rather than granting broad, persistent access by default.
Privacy Meets Automation
For Apple, the new controls may serve both a defensive and strategic purpose. By tightening Full Disk Access, the company can reinforce its privacy posture while also setting the terms for how third-party AI tools operate on its platform. That could shape the next generation of Mac software, forcing developers to justify access more precisely and potentially encouraging more granular permission models.
The broader industry implication is clear: AI safety is no longer only about model behavior, content moderation, or hallucinations. It is also about system permissions, data boundaries, and the architecture of trust inside operating systems. As AI agents become more capable, the question is not simply what they can say, but what they can see and do.
Apple's warning suggests that the age of agentic computing will require a new security playbook. On macOS, that begins with one of the system's most powerful permissions and a recognition that broad access, once a convenience, is becoming a liability.