Apple Tightens macOS Full Disk Access Over AI Agent Risks — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Apple announced plans to tighten macOS Full Disk Access (FDA) controls, saying some developers are using the setting in ways that expose users' files, mail, messages, and browsing history "without users' full knowledge and understanding."
- The upcoming changes will require an explicit user action to grant FDA, though Apple has not disclosed a rollout timeline; the setting was introduced in macOS Mojave (10.14) and currently lets approved apps bypass system-level security restrictions to read and write protected files.
- Meta's Muse "personal AI agent" appears to be the trigger — a recent report said it read a journalist's private iMessages after the user granted it FDA, and Meta CTO David Singleton confirmed the Messages integration requires both FDA and an opt-in Messages connector setting in Muse.
- Security researcher Patrick Wardle released a proof-of-concept exploit dubbed "not-a-mused" for a now-patched zero-day in Muse's Mac app that lets any unprivileged local process capture the token authenticating users to their Muse account, redirect dictation traffic, and inject malicious prompts.
- Wardle was separately credited with reporting CVE-2026-100754 in OpenAI's ChatGPT app for Mac — a now-patched flaw that could have been abused to take over the AI assistant and access chat logs and other data stored by the app.
- Apple framed the shift as necessary because agentic tools' deep access — writing files, using the mic and camera, creating calendar events, sending email, and monitoring location — substantially widens the local attack surface for adversaries.
Why it matters: The FDA tightening directly targets the privileged path that made Meta's Muse able to read a journalist's iMessages, and Apple's own framing — that AI agents' expanding OS-level access is a growing risk — signals platform-level guardrails are coming for every agentic app, not just one vendor. With Wardle's two disclosed flaws showing both Muse and ChatGPT's Mac apps were exploitable by local attackers, Apple's timing reflects a concrete pattern of abuse, not a theoretical concern.
Ask SkimNews
