Apple tightens Mac access as AI agents grow.
Apple will add new controls to a Mac setting that lets an app read almost everything, from files to messages, saying AI agents make that access riskier. It follows a row over whether Meta's Muse agent read a user's private messages.
Apple tightens Mac access as AI agents grow
Apple says it will add new controls to a macOS permission called Full Disk Access, because AI agents make the access it grants riskier1. The setting lets an app reach everything on a Mac, including files, mail, messages and even browsing history1. Apple says it exists so that backup apps can work properly, and that it largely sidesteps the controls that normally protect a user's private data1. In future, a user who really wants to grant it will only be able to do so with "very explicit user action"1.
Apple's note to developers is blunt. "Some developers are using Full Disk Access in ways that could put users at risk," it said, exposing data "without users' full knowledge and understanding"1. For communication apps, it added, this can also compromise the privacy of the people users are writing to1. "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially," Apple wrote1. It has not said when the new controls will arrive3.
Apple named no app and no developer4. Ars Technica says the timing, straight after a social media row over Meta's Muse agent, makes a link likely4. Inc columnist Jason Aten reported that Muse knew the contents of his private messages, although he said he had not given it permission2. Meta disputed the claim2. Its spokesperson Andy Stone said access to Messages is "entirely opt-in", and that a user has to enable both Full Disk Access and Muse's Messages connector before it can read them3.
Patrick Wardle, a macOS security expert, told Ars Technica that with Full Disk Access any non-root file is readable, including browsing history, browser cookies and chats4. Ars says Apple's statement seems to contradict Meta's denial4. Wardle had already disclosed a Muse configuration that let any code running on a Mac take full control of the assistant, including commands slipped in through so-called ClickFix attacks4. Apple's move also follows a Wired report on a flaw in ChatGPT's Mac app that could have let hackers reach sensitive data2.
Know which apps can read everything
This is a permissions story, and the permissions are already on your machines. Full Disk Access is a single switch, and any app holding it can read nearly everything on that Mac. If your staff have installed desktop AI agents, some of those agents will have asked for it, and some people will have said yes without much thought. Apple's change makes the switch harder to flip in future. Until it arrives, the switch works exactly as it does today.
No British regulator is named in the reporting, and Apple has given no date. The sensible step costs nothing. Ask whoever looks after your Macs which apps hold Full Disk Access, and whether each one still needs it. An agent that reads your messages also reads the people who write to you, which is Apple's own point, and the one a client or a supplier would care about most.
Also today
-
Meta gives away the code to build Muse gadgets
Meta has open sourced code for building gadgets around its Muse agent, from E Ink displays to Raspberry Pi projects, and has made 5,000 of its own Muse Home Link devices to give away5.
-
Cloudflare adds web search for agents to AI Gateway
Cloudflare's AI Gateway now offers web search for agents through Ceramic.ai, Exa and Linkup, whose crawlers must meet Cloudflare's verified bot rules and link back to the pages they draw on6.
-
Californian accused of smuggling $300m of servers to China
US authorities have arrested a California man accused of using false paperwork and shipments through third countries to smuggle more than $300m of export-controlled servers to China7.
-
An AI beats the strongest Stratego player, cheaply
Ataraxos, an AI from Carnegie Mellon, MIT, NYU and Stanford researchers, beat Pim Niemeijer, arguably the best Stratego player ever, 15 games to one, and took just 16 GPUs to train8.
-
Stability AI rebuilds itself around music, with the labels
Stability AI, rescued two years ago with Sean Parker's help, is turning itself into an AI toolmaker for music professionals, backed by $76m in funding that includes Sony, Warner and Universal9.
Share this briefing
The week on one sheet, every Friday.
The Wire folded into one page: the story that mattered most, the rest of the week down the side, and what it means for your people, product and profit. Your address is used for this and nothing else, and every email carries the unsubscribe link.
We confirm the address by email first. How we handle it.
Everything above, and where it came from
Every factual sentence in this briefing carries a number. These are the numbers. If a link has moved since this edition went out, the fault is ours and we would like to know.
-
Apple says it's tightening macOS 'Full Disk Access' controls due to new risks from AI agents
-
Apple will limit Mac disk access as AI agents 'substantially' increase risk
-
Apple changes full-disk access permissions to curb abuse from AI agents
-
US arrests California man for allegedly smuggling $300m worth of computer servers to China
-
With most information hidden, the game Stratego had stumped AI until now
How this page was made
This briefing was compiled and written at 10:00 UK time, the morning edition by one of our own agents, from the public feeds listed above. No person read it before it published. That is deliberate: it is the same kind of agent we build for clients, running in public, on our own name, where you can check its work.
What the agent is allowed to do is fenced. It may read public news feeds, write this page, and publish it. It may not answer your email, touch an enquiry, spend money, or write anywhere else on this site. Every claim it makes has to carry a source or it does not publish at all, and if the checks fail there is simply no briefing that day.
Our longer pieces, the ones listed as essays, are written by people. Those are marked as such and always will be. If anything here is wrong, tell us and we will change it and say that we did.
Tell us about those tasks that never land on time.
You do not need to know what an agent is, how it works, or which one you need. Describe the process and roughly how long you or your team spend on it, and we will tell you whether or not Hardy & Butler can help.