Apple Moves to Tighten macOS Full Disk Access After Meta's Muse AI Agent Draws Privacy Complaints

What happened

Apple said on October 2, 2026 that it will change its Mac operating system to make it more obvious when AI agents ask to read all of the data on a Mac, tightening the macOS "Full Disk Access" permission after Meta's Muse AI agent drew complaints from users who said it had reached private messages, as reported by The Straits Times on October 3, 2026 at 09:00 AM, updated 11:58 AM. The company said in a post: "Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action," adding that "as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."

Muse, an AI agent unveiled by Meta CEO Mark Zuckerberg at Meta Connect on September 23, 2026, is capable of complex tasks such as cancelling unused subscriptions or haggling for better prices. Inc magazine technology columnist Jason Aten accused Muse of reading private messages on his Mac, saying he had not enabled Full Disk Access. Meta spokesman Andy Stone pushed back on that account: "You have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content... And it can be revoked at any time." Meta CTO David Singleton had earlier defended Muse as strictly opt-in.

The context matters for how the dispute landed on Apple's desk. iPhones and iPads sandbox apps by default, meaning no app can read another app's data, but Macs allow a "Full Disk Access" option under which apps such as cloud backup services can read all data on a machine with user permission. That permission has become the fault line in the argument over what Muse could and could not see.

Why it matters

The episode puts a spotlight on the gap between mobile and desktop privacy models at exactly the moment AI agents are being sold to consumers as assistants that act across a user's digital life. An agent that cancels subscriptions or negotiates prices is, by design, an agent that touches many services at once, and on the Mac the broadest such reach runs through Full Disk Access. Apple's own framing acknowledged the stakes, warning that the risks of granting an app this level of access "will grow substantially" as agents become more capable and autonomous.

Security researchers have documented how wide that door already is. According to Cumhuriyet, published October 3, 2026 at 13:12, macOS security expert Patrick Wardle and other researchers showed that any app granted Full Disk Access can read chat histories, browser cookies and private emails. The same report said a configuration flaw in Muse could let attackers seize full control of the assistant via ClickFix attacks, and that Amazon blocked Meta's Muse from its platform after the scandal. Neither claim has been answered in detail by Meta: Apple declined to comment beyond its post, and Meta did not immediately respond to a request for comment, via Reuters.

For Apple, the announcement is also a competitive signal. The company controls the permission architecture on which third-party agents must run, and tightening it sets the terms under which rivals' AI products, including Meta's, can operate on Mac hardware. For Meta, the dispute is a reputational test for a product launched less than two weeks before the complaints surfaced, with its own executives split between defending opt-in design and fielding accusations that users had not consented to message access.

How it is being covered

The story is carried by 59 sources, with a political split of 25 percent left, 50 percent centre and 25 percent right, according to ground.news. Of the 20 rated outlets, 13 rate as high factuality and 5 as very high, with one mixed-to-low outlier at each end of the scale, and no blindspot was identified across the political spectrum. Coverage is broad rather than polarised, with technology and business desks on both sides of the spectrum treating the Apple permission change and the Meta complaints as a single story.

What to watch

Three threads remain open. First, the shape of Apple's new controls: the company has said only that granting Full Disk Access will require "very explicit user action," and the technical details, timing and whether the change applies to existing apps as well as new ones are not yet specified. Second, Meta's response: the company has not answered the ClickFix configuration flaw reported by Cumhuriyet, nor Amazon's reported blocking of Muse from its platform, and any statement from Meta on either point would move the story. Third, whether regulators or platform reviewers take up the researcher findings that Full Disk Access apps can read chat histories, browser cookies and private emails, since that finding extends beyond Muse to every app holding the permission. Watch also for whether other AI agent makers comment on the new macOS rules, given that the permission change will bind them as much as it binds Meta.

By the numbers

Source snapshot