Apple tightens macOS privacy rules as AI agents demand full disk access

Apple has moved to restrict how developers request Full Disk Access on macOS. The company stated on its developer blog that some developers are using this permission in ways that expose user files, mail, and browsing history without clear consent.

This change directly impacts the current wave of "personal agent" tools that need deep system integration to perform tasks like email management or file organization. The shift comes as the industry debates the architecture of these new assistants. While Apple focuses on security, other developers are pushing for broader autonomy. Nathan Baschez, a product designer at Notion, argues against the "personal agent" model in a recent essay for The Leverage. He contends that the trajectory of work is not about a single agent handling everything, but about "factories": shared AI systems designed to handle specific task types within an organization. This view suggests that the monolithic agent Apple is wary of may be replaced by more modular, specialized infrastructure.

Microsoft is also weighing in on how these agents should be evaluated.

A joint report with Hugging Face, released on 3 October, details "ThinkingBox," a benchmark that grades AI agents based on the database records they leave behind rather than the text they generate. The study found that in a set of 121,680 trials, 67.24% of failed attempts still appeared to terminate cleanly to an observer, even though the underlying data was incorrect. This highlights a critical gap: agents often sound confident while executing errors that only backend state checks can reveal. The numbers suggest that surface-level success metrics are dangerously misleading for these systems.

Infrastructure for the agent era

As enterprises adopt these tools, a new layer of software is emerging to support them. Spawned, a cloud platform for agents, launched to allow AI systems to provision and manage real infrastructure in AWS, GCP, or Azure. Unlike traditional consoles, Spawned is designed to be operated by agents, providing a declarative framework that prevents "hallucinated components" and runaway cloud bills.

The platform emphasizes that resources are exportable and Terraform-compatible, ensuring that companies are not locked into a new vendor solely because their AI uses it. Security concerns extend beyond local permissions to network identity. AgentID, a service from AgentMail, proposes that agents should have their own digital identities rather than borrowing user credentials. When an agent uses a human's login, the application cannot distinguish between the person and the bot.

If the agent misbehaves, the only way to stop it is to change the user's password, locking out the human as well. AgentID gives the agent its own inbox and sign-in key, allowing the owner to revoke access without affecting their personal account. The complexity of managing these systems is further complicated by "agent drift." A guide published on 4 October explains that an agent's behavior can change without any code updates. This happens when the underlying model, tools, or data sources evolve. Since agents operate in a system of systems, a change in a dependency library or a model provider's safety controls can alter the agent's output. This means that traditional release management is insufficient; teams must monitor the entire ecosystem continuously. For developers building these agents, the tooling is becoming more specialized. Kimchi, a coding agent platform, enforces hard budget caps and ensures zero model-data egress, keeping code and prompts within company boundaries. Similarly, Cosh offers a Rust-based terminal agent that avoids context truncation, a common issue in long-running sessions.

These tools reflect a growing consensus that autonomy must be paired with strict operational guardrails. Apple's intervention acts as a reminder that as AI agents become more capable, the risks associated with their access to personal data will grow substantially. The company has not detailed the specific technical mechanisms of the new controls, but it emphasized that granting such "extraordinary" access will now require very explicit user action. As the industry races to build the next paradigm, the tension between autonomy and privacy is becoming the defining constraint.