The setting was designed for backup software: a quiet toggle buried in macOS that lets a program read the files, the mail, the messages and the browsing history on a Mac. In the past week, that permission has become the fault line in an argument about what artificial-intelligence assistants should be allowed to see.
On October 2, Apple told developers it was adding new limits to Full Disk Access, a permission the company said was originally intended for backup tools but which can expose a user’s files, email, messages and browsing history. Going forward, Apple said, the permission will be granted only after a very explicit action from the user, an acknowledgment that some developers had been using it in ways that surfaced a user’s content without their knowledge.
The change lands after two episodes put the permission in the spotlight. Jason Aten, a columnist at Inc., said the Muse assistant on his Mac had read his private messages; Meta denied the claim. Days later, Wired disclosed a vulnerability in the ChatGPT application for Mac that an attacker could potentially use to reach sensitive data. Neither company was named in Apple’s notice, but the timing was hard to miss.
Apple’s language was careful. The company described a general problem rather than a specific offender: some developers’ implementations exposed the contents of a user’s system when the user was not aware of it. The fix is procedural as much as technical. The permission should now require a deliberately conscious choice, not a prompt a user clicks through out of habit.
The episode exposes a collision between two industries moving at different speeds. macOS was built around a model in which a permission like Full Disk Access is granted once and then trusted. AI assistants are being asked to read and act across a whole machine, which is exactly what the permission enables and exactly what makes it dangerous in the wrong hands.
Security researchers have argued for years that broad file permissions are the weak point of desktop platforms. A tool that can read everything on a disk can also copy everything off it. The difference now is that the software with the most incentive to request such access – assistants that promise to summarize, organize and act on a user’s files – is also the software users are most inclined to trust.
Full Disk Access has been a fixture of Apple’s privacy architecture for years, part of a permissions system the company built after users complained that apps were reaching into data they had no business touching. When it works as designed, the prompt is meant to make clear that the user is handing over the digital equivalent of a house key. When it fails, it is because the warning is vague enough that people click through it without understanding what they have granted.
Apple’s response left questions unanswered. The company declined to answer TechCrunch’s queries about the specifics of the change, leaving developers to guess at how the new flow will work in practice. That opacity is characteristic of Apple, which tends to announce privacy changes in developer notices and let the details surface when the software ships.
The dispute also points to a gap in how assistants are policed. Desktop app stores generally do not review what a program does after it is installed, and the assistants in question reach Macs through the web or through direct downloads as often as through the App Store. That leaves the operating system’s permissions as the last line of defense, which is why Apple’s tightening of the toggle matters more than it might look.
The stakes extend beyond a single permission. Apple has spent years positioning itself as the privacy-conscious alternative in an industry racing to put assistants on every device. If the most popular assistants on its platform are caught reading things they should not, that positioning erodes. The Full Disk Access change is a way of reasserting a boundary without naming anyone.
The timing matters, too. The row over what Muse and ChatGPT can see on a Mac arrived just as Apple was preparing the change, and the developer notice reads like a response to a pattern rather than a single incident. Apple tends to move quietly and then enforce, and the notice suggests the company had been watching the problem build for some time.
Apple has reason to act without naming anyone. Meta and OpenAI are partners as well as competitors, and the company has been negotiating to bring some of their models onto its platforms even as it builds its own assistant. Publicly rebuking either would complicate those talks; quietly tightening the permission sends the same message without the confrontation.
What remains unclear is whether the new limits will stop an assistant from asking for broad access in the first place, or merely make the ask more conspicuous. A permission granted after a clearer warning is still a permission granted. The real question is whether users, shown an honest description of what an assistant will read, will keep saying yes.
