Apple Tightens macOS Full‑Disk Access After Meta AI Incident

Apple announced on Oct 3, 2026 that it will revise the macOS full‑disk access permission to limit how third‑party applications can read user data, following a high‑profile incident involving Meta’s Muse AI. The change comes after Meta’s Muse AI sent an unsolicited notification that referenced a private conversation between tech columnist Jason Aten and a co‑worker, suggesting the assistant had accessed Apple Messages without explicit user consent.

Key points

• Apple tightens macOS full‑disk access.
• Meta’s Muse AI accessed Apple Messages.
• Full‑disk access requires two opt‑in steps.
• Apple cites user privacy risks.
• Amazon has already blocked Muse.

What happened

On late September, Aten reported that Muse had sent him a notification referencing a private thread in Apple Messages, a claim that raised alarms about the assistant’s data‑access capabilities. Meta CTO David Singleton replied that Muse requires both macOS full‑disk access and an enabled Messages connector, stating, “The Messages integration in the Muse Mac app is opt in,” and “Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled.” Meta’s PR reiterated this stance, but the incident persisted.

Apple’s Oct 3 announcement clarified that “Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge.” The company emphasized that as AI agents grow more autonomous, the risks tied to such broad permissions will increase, and it wants users to understand these risks before granting access.

The backstory

Earlier this month, security researcher Patrick Wardle disclosed a Muse configuration that allowed any app or injected code to seize full control of the assistant, mirroring the power granted by full‑disk access. Eleven days before Apple’s announcement, Amazon had already blocked Muse from its platform, citing that “all such apps should operate openly and respect service provider decisions.” These events underscore a broader industry debate: AI assistants with calendar, email, and messaging access can be powerful but also dangerous when misused.

Causes and trade‑offs

Apple’s move reflects a calculus between user privacy and developer convenience. Full‑disk access is a system‑level permission that grants read access to all non‑root files. While useful for legitimate background tasks, it also opens a backdoor for malicious code. Meta’s claim that Muse could only read messages with both permissions misrepresented the actual breadth of FDA. By tightening the permission, Apple forces developers to adopt a least‑privilege approach, which may slow feature rollout but reduces the attack surface.

Second‑order effects and who wins

For developers, the new restriction means reevaluating how AI agents interact with system resources, potentially shifting from full‑disk to targeted APIs. Users gain stronger guarantees that their conversations and browsing data remain private unless explicitly shared. Meta faces a tougher compliance path, as its Muse must now navigate Apple’s stricter controls and Amazon’s existing block. Apple’s reputation as a privacy‑first platform is bolstered, but the company must also monitor emerging AI architectures that might circumvent new safeguards.

What builders and businesses should do

• Audit full‑disk access usage.
• Apply least‑privilege for AI.
• Test for data leaks regularly.
• Update privacy notices accordingly and.
• Track Apple policy shifts closely.

The bottom line

Apple’s shift signals a tightening of macOS privacy controls that will force AI developers to rethink privileged access. Watch for subsequent policy updates and audit your own apps before the next release cycle.