Apple tightens macOS privacy as AI agents request full disk access

Apple warned on 2 October that some developers are using the Full Disk Access setting in ways that could put users at risk. The setting exposes files, mail, messages, and browsing history without user knowledge.

The privacy gap

According to 9to5Mac, Apple explained that Full Disk Access was originally designed to allow backup apps to function properly. It now largely sidesteps privacy controls. The company noted that as AI agents become more capable, the risks associated with this level of access will grow substantially. Users will soon need to take very explicit actions to grant an app this extraordinary level of access. This shift marks a departure from the passive permission models that have defined macOS for the past decade. It signals a move toward active, granular user consent for sensitive data.

This move comes amid the rapid rise of tools like Meta Muse and OpenAI’s Dots. These are always-on AI agents that request substantial access to personal data. 9to5Mac reported that horror stories about Meta Muse have already emerged. They highlight the tangible dangers of broad agent permissions on personal devices.

Enterprise tooling shifts

While Apple addresses the consumer side, enterprise developers are rapidly building infrastructure to manage agent behavior and costs. Kimchi, a Pi-based coding agent platform, enforces hard budget caps and real-time spend attribution before a request hits a model. This ensures that model data stays within organizational boundaries and prevents uncontrolled spending.

Microsoft and Hugging Face released ThinkingBox, a benchmark that grades AI agents on the records they leave behind rather than the sentences they generate. In a common-set ablation covering 121,680 valid trials across 12 LLM models, 79,853 attempts failed executable checks. Of those failures, 67.24% still terminated cleanly and reported no final tool error. Yet executable checks found wrong field values in 77.61% of them. This demonstrates that agents can sound correct while leaving the wrong state in a database. It is a critical failure mode for production systems.

Security researchers have also identified new vectors for agent manipulation. SC Media reported that researchers bypassed AI agent protections using JavaScript obfuscation. This technique allows malicious code to hide within web content. It tricks agents into executing unintended actions. The finding highlights the need for strong validation layers in enterprise agent deployments.

Identity and oversight

AgentMail is promoting the concept of giving AI agents their own identity rather than having them borrow user credentials. According to AgentID, handing an agent a user's password makes every app think the agent is the user. Giving the agent its own identity, with its own inbox and sign-in key, allows apps to see the agent as a distinct principal. The user is recorded as the accountable owner. This separation limits the blast radius if a credential leaks.

Emre Turan’s paper, "Oversight Has a Capacity," argues that human-in-the-loop approval gates are not sufficient on their own. The study found that when the reviewer is modeled as fatiguing, realized safety becomes an inverted-U in the escalation rate. More human oversight can make a system less safe if the reviewer is overwhelmed. The safety-optimal guard escalates below full escalation. This suggests that automated pre-filtering is essential to protect human attention.

Design systems are also evolving to accommodate agents. Luke Wroblewski notes that when agents write most of the code, the design system becomes part of the AI steering layer. An AGENTS.md file can instruct AI agents to reuse theme classes and CSS variables. This ensures that any website update remains aligned with brand and development guidelines. The approach allows marketing, engineering, and product teams to update sites simultaneously without breaking design integrity.

Infrastructure and context

Spawned offers a cloud infrastructure interface specifically designed for agents. It allows them to provision, scale, and operate resources in AWS, GCP, or Azure. The platform ensures that deployments are real cloud infrastructure, exportable and Terraform-compatible from the start. This gives enterprises control over what agents build in their cloud environments.

For developers working with agents, tools like Nautilus allow coding agents to be run from a phone, with the work merged on a PC. This separation of prompting and reviewing uses the portability of mobile devices for initiating tasks. It uses the precision of desktop environments for code review. The tool runs on free cloud infrastructure, requiring no credit card or paid VM.

As these tools proliferate, the focus is shifting from raw model capability to reliable execution, secure identity, and manageable oversight. The industry is moving toward a model where agents are treated as distinct, accountable actors with strict boundaries on their access and actions.