What did Apple announce about Full Disk Access on October 2, 2026?

In a developer news post titled Updates to Full Disk Access in macOS, Apple said some developers use the permission in ways that expose files, mail, messages and browsing history without users fully understanding it, and that it will add controls so the permission can only be granted with very explicit user action. Apple tied the change to AI agents becoming more capable and autonomous.

When will Apple's new Full Disk Access controls arrive?

Apple has not said. The notice gives no date, no macOS version and no design details, and Engadget reported that Apple did not say what exactly will change. Until something ships, Full Disk Access works the way it does today.

Does my coding agent have Full Disk Access if I never granted it to the agent?

It can. Apple's Developer Technical Support explains that macOS checks the responsible code for a process, and when you run a tool from Terminal, Terminal is the responsible code. If your terminal or IDE has Full Disk Access, agents and tools you start there run with it. Apple notes the exact algorithm is undocumented and may change.

Did Meta's Muse read a journalist's messages without permission?

That is disputed. Inc. columnist Jason Aten wrote that Muse synced his Messages database while Full Disk Access showed as off. Meta says Muse cannot read Messages unless the user enables both Full Disk Access and the Messages connector, and that macOS protections cannot be bypassed. It has not been independently verified.

How do I check which apps have Full Disk Access on my Mac?

Open System Settings, then Privacy and Security, then Full Disk Access. Every app with its switch on has the permission. Pay special attention to terminals and IDEs, desktop agent apps, and the Remote Login setting that can give SSH sessions full disk access.

Should I turn off Full Disk Access for my terminal?

If you run coding agents in it and do not need system-wide reads for daily work, turning it off limits what those agents and their tools can reach. Switch it off, see what breaks, and only turn it back on for a specific task that needs it.

What should developers of desktop AI agents use instead of Full Disk Access?

Apple's documentation describes asking the user to pick a file or folder in a standard open panel, which extends the app's access to that folder and everything inside it, and keeping that access across launches with a security-scoped bookmark. Apple DTS advises asking for Full Disk Access only after a concrete failure, with an explanation.

What does Microsoft's Digital Defense Report 2026 say about AI agents?

It says attackers already treat AI as an attack surface and lists five risk classes for agents, including sensitive data exposure and excessive agency. It reports that 88% of enterprises are experimenting with AI agents and recommends reducing oversharing, least privilege, and treating agents as identities.

Is Full Disk Access only meant for backup apps?

Apple says the permission largely sidesteps its privacy controls so backup apps can work. MacStories pointed out that many non-backup utilities rely on it, such as launchers and file tools, and worried Apple may restrict which apps can use it. John Gruber shared that worry while noting most Mac users do not realize how much it grants.

You Already Gave It the Keys: What I Learned Researching Apple's Full Disk Access Crackdown on AI Agents

On October 2, Apple said macOS Full Disk Access will need very explicit user action because of AI agents. The bigger finding: if your terminal has it, every coding agent you start there inherits it. What it exposes, who asks for it, and a 10-minute audit, with 12 sources.

Here is the whole argument up front. On October 2, 2026, Apple said Full Disk Access on the Mac will soon require "very explicit user action," because AI agents make that permission more dangerous S1. Most coverage reads this as a story about desktop agent apps like Meta's Muse. The more useful lesson for developers is quieter. macOS ties a privacy permission to the app responsible for a process, and when you run a tool from Terminal, Apple's developer support says Terminal is that app S2. So if your terminal or IDE has Full Disk Access, every coding agent you start there, and everything that agent spawns, runs with it. Apple has not said when its new controls will arrive S3. You do not need to wait for them to find out what your agents can already read.

I started this expecting to write about Muse and a disputed magazine column. What changed my mind was a 2024 answer from Apple's Developer Technical Support on the developer forums, read next to a Ghostty thread from June in which developers describe granting Full Disk Access to their terminal so Claude Code can reach their project folders S2 S4. The honest answer to "did I give an agent Full Disk Access?" is often different from the one we would give from memory. This post is the research, the dissent, and a 10-minute audit. No code required.

Diagram: a terminal or IDE with Full Disk Access switched on launches a shell, which launches a coding agent CLI that runs with the same grant, and the agent's MCP servers, build scripts and dependency install hooks inherit it too. The grant reaches files, mail, messages and browsing history, per Apple's October 2, 2026 notice.

FIG. 01 · Grant it to the terminal, and every agent inherits it · macOS checks the responsible app, not the tool you typed S1 S2

What did Apple actually announce?

The notice is two paragraphs on Apple's developer news site, titled "Updates to Full Disk Access in macOS" S1. Apple says the permission largely sidesteps the privacy controls behind its APIs so that backup apps can work, and that some developers are using it in ways that expose files, mail, messages and browsing history without users fully understanding what they agreed to S1. For communication apps, Apple adds, that also exposes the people on the other side of the conversation S1. Going forward, granting it will take explicit action, and Apple ties the urgency directly to agents becoming more capable and autonomous S1.

What the notice leaves out matters as much. It names no app, no macOS version and no date, and Engadget notes that Apple did not say what exactly will change from the current setup S3. TechCrunch reported that Apple did not respond to its questions about the change S5. Everything after "additional controls" is speculation, including mine.

Timeline from September 19 to October 2, 2026, drawn to scale: Jason Aten's column on Muse on September 19, Meta disputing it on September 30, then Apple's developer notice and Microsoft's Digital Defense Report 2026 on October 2, thirteen days later. A dashed extension ends at the new controls shipping, which has no announced date. Chips list what the notice leaves out: no app named, no macOS version, no date, no design details.

FIG. 02 · Thirteen days from one column to a platform notice · and still no date for the controls themselves S1 S3 S6 S7

Why did Muse become the test case?

Apple named no one, but the timing points at Meta's Muse. According to The Next Web's account, Inc. columnist Jason Aten wrote on September 19 that he installed Muse on an iPhone and a Mac mini, chose not to give it access to his messages, and then got a column suggestion built on a conversation he had just had with his podcast co-host S6. When he asked how it knew, Muse said it only saw notification banners. Aten then found Muse had synced his Messages database up to row 187,462, while its settings showed Full Disk Access switched off S6.

Meta disputes this. Its communications chief Andy Stone said Muse cannot read Messages unless the user turns on both Full Disk Access and the Messages connector inside the app, and Meta Superintelligence Labs executive David Singleton said the macOS protections cannot be bypassed even if the app had a bug S6. I cannot settle that, and nobody can without a forensic look at Aten's Mac, so I am treating it as disputed. I did not open Aten's original column myself; the details above come from The Next Web.

The part nobody disputes is the onboarding pattern. Engadget reports that desktop clients for agents like OpenClaw, Dots and Muse often encourage users to grant Full Disk Access, and that some people now run agents on dedicated machines instead, which helped fuel Mac mini shortages this year S3.

Why does my coding agent probably have it already?

This is the section I wish I had read first. macOS privacy checks (Apple calls the system TCC) are not made against whichever program touches the file. They are made against what Apple's developer support calls the responsible code S2. Quinn, an engineer in Apple's Developer Technical Support, lists the common cases: when a user runs a tool from Terminal, Terminal is the responsible code, and when an app spawns a helper tool, the app is S2. He also warns that the exact algorithm is not documented, has changed before and may change again S2.

Follow that through. If Terminal, iTerm2, Ghostty or any other terminal has Full Disk Access, a coding agent CLI you start inside it runs with that access, and so does everything the agent launches: the MCP servers it starts, the scripts it runs, and any install hook buried in a dependency tree. That last one is not hypothetical. A dependency's install hook is exactly how the keyv worm I wrote about ran on developer machines, and started from a terminal with Full Disk Access, a hook like that would inherit it.

Developers are granting it in practice. In a Ghostty discussion from June, a user describes giving Ghostty Full Disk Access and expecting Claude Code sessions inside it to keep access to project directories, and other commenters report the same setup with Codex S4. A VS Code issue describes the same rule for IDEs: when the integrated terminal spawns a process, macOS treats VS Code as responsible for it, and one commenter notes those commands are increasingly run by coding agents such as Claude Code and Codex S8.

There is one more path people forget. With Remote Login on, Quinn notes that the SSH server becomes the responsible code, and macOS has a separate setting that gives remote sessions Full Disk Access S2.

What does Microsoft's report add?

Microsoft's Digital Defense Report 2026, whose page is dated October 2, reads like the other half of the argument S7. Microsoft says attackers already treat AI as an attack surface, exploiting it to run malicious commands and exfiltrate data, and it lists five risk classes for agents S7. Two of them map straight onto Full Disk Access: sensitive data exposure, where an attacker drives an agent to read beyond its sanctioned scope, and excessive agency, where an agent is coaxed into tools and actions beyond what it was allowed S7. Full Disk Access does not create either risk. It decides how far each one can reach.

Microsoft's five risk classes for the 2026 agentic attack surface: prompt and intent manipulation, sensitive data exposure, identity and privilege compromise, excessive agency, and operational integrity. Sensitive data exposure and excessive agency are highlighted as the two where Full Disk Access sets the reach. A side panel shows figures from the same report: 88% of enterprises experimenting with AI agents, and a malicious extension with 600,000+ installs that harvested ChatGPT and DeepSeek history and affected almost 10,000 organizations.

FIG. 03 · Two of Microsoft's five agent risks are about reach · filled rows are my read, the names and descriptions are Microsoft's S7

Two figures from the report set the scale. Microsoft says 88% of enterprises are already experimenting with AI agents S7. It also describes a malicious browser extension with more than 600,000 installs that harvested ChatGPT and DeepSeek conversation history and affected almost 10,000 organizations before it was mitigated, and it notes that this kind of history now routinely holds source code, architecture, customer data and leaked credentials S7. These are Microsoft's own numbers, and I have no independent count. Its advice is the boring kind that works: reduce oversharing, apply least privilege, and treat agents as identities in their own right S7.

Is Apple right that this was built for backups?

Not everyone accepts Apple's framing. John Voorhees at MacStories looked at his own MacBook Pro and found that only a handful of the apps holding Full Disk Access were backup tools; the rest included Alfred, PopClip, Hazel, Pixelmator Pro and even an Apple Arcade game S9. He agrees the agent concerns are well founded, but worries that the backup framing signals Apple may restrict which kinds of apps can use the permission at all S9.

John Gruber at Daring Fireball shares that worry as a power user who relies on Full Disk Access, then makes the counterpoint I find hardest to argue with S10. On an iPhone, no permission lets a third-party app read your email or your end-to-end encrypted messages. On a Mac, saying yes to everything an agent asks for hands over most of the startup drive, and many Mac users do not know the difference S10.

My read is that both are right. The new controls will add friction for power users, and the way to avoid fighting them is to need the permission less.

How would I audit this in 10 minutes?

Open System Settings, then Privacy and Security, then Full Disk Access, and go down the list with these questions.

Step	Look for	Why it matters
1	Every app with the switch on	That list is your real exposure, not the apps you remember approving S1
2	Terminals and IDEs	Everything launched inside them inherits the grant S2 S8
3	Desktop agent apps	Many ask for it during setup S3
4	Backup tools	The case Apple says the permission exists for, so usually keep S1
5	Remote Login	A separate setting can give SSH sessions full access S2

For every row that is not a backup tool, switch it off and see what breaks. If an agent only needs a project folder, it should not need the disk. If you do want an agent to have broad access, the dedicated machine Engadget describes, or at least a separate macOS user account with nothing sensitive in it, is a cleaner boundary than a toggle on your daily Mac S3.

A generic Full Disk Access settings pane with five rows, all switched on, each with a verdict: Terminal or IDE that launches coding agents, turn off; desktop agent app that asked during setup, turn off; backup app, keep; launcher or file utility, decide; Remote Login (SSH) with full disk access for remote users, check. A side panel asks of every row: does it launch programs, does it need the disk or one folder, and would you notice if it read files, mail, messages and browsing history.

FIG. 04 · The 10-minute audit in one settings pane · a generic example, not a screenshot S1 S2 S3 S11

What should agent builders do before Apple ships the change?

Design as if the new controls are already here. There is no API to request Full Disk Access; the user has to switch it on, and Quinn's long-standing advice is to defer the request until there is a concrete failure, then explain it and suggest the permission as the remedy S11. Apple's documentation says the same from the other side: an app cannot gain full disk access through an entitlement or with code, so it should handle the failure gracefully S12.

The narrower path is already documented. When a user picks a file or folder in a standard open panel, macOS extends the app's sandbox to it, and for a folder that includes everything nested inside; a security-scoped bookmark keeps that access across launches S12. For an agent, that means asking for the project folder, not the drive.

Five macOS file access paths drawn as bars from narrowest to widest, in order rather than to scale: the app container; a user-selected folder, including nested items; a security-scoped bookmark that keeps the same pick across launches; Files and Folders, with per-user consent for protected folders; and Full Disk Access, the widest bar, covering files, mail, messages and browsing history, with no API to request it. The user-selected folder and bookmark rows are shaded as where an agent should usually live.

FIG. 05 · Ask for a folder, not the disk · order, not scale; the last step is granted only in System Settings S1 S11 S12

What does the side-by-side look like?

Access path	What it reaches	How it is granted
Full Disk Access	Files, mail, messages and browsing history S1	A user switch in System Settings, with no API S11 S12
Files and Folders	Protected folders, per user, skipped entirely by Full Disk Access S11	User consent, per user S11
User-selected file or folder	Only what the user picked, nested items included S12	A standard open or save panel S12
Security-scoped bookmark	The same pick, kept across launches S12	Created by the app after the pick S12

Which one should you reach for?

Keep Full Disk Access on if:

The app is a backup tool that has to read everything S1
You have checked that it cannot work from a picked folder S12
The machine or user account exists only for the agent S3

Turn it off if:

It is a terminal or IDE you run agents in S2 S8
It is an agent app that asked for it during setup S3
You cannot say what it needs it for S1

If you ship a desktop agent:

Ask for a project folder through the standard open panel S12
Keep that choice with a security-scoped bookmark S12
Ask for Full Disk Access only after a real failure, and say why S11

What would I do differently next time?

Start with the mechanism, not the drama. I began with the Muse dispute; the finding that changed my own setup advice was a 2024 forum answer about responsible code S2.
Treat "the agent" as a process tree. An agent is never one app. It is whatever the terminal, the CLI and its tools add up to S2 S8.
Read the dissent before writing the conclusion. MacStories and Gruber moved me from "Apple is right" to "Apple is right about agents and vague about everything else" S9 S10.

FAQ

What did Apple announce about Full Disk Access on October 2, 2026?
In a developer news post titled Updates to Full Disk Access in macOS, Apple said some developers use the permission in ways that expose files, mail, messages and browsing history without users fully understanding it, and that it will add controls so the permission can only be granted with very explicit user action. Apple tied the change to AI agents becoming more capable and autonomous.
When will Apple's new Full Disk Access controls arrive?
Apple has not said. The notice gives no date, no macOS version and no design details, and Engadget reported that Apple did not say what exactly will change. Until something ships, Full Disk Access works the way it does today.
Does my coding agent have Full Disk Access if I never granted it to the agent?
It can. Apple's Developer Technical Support explains that macOS checks the responsible code for a process, and when you run a tool from Terminal, Terminal is the responsible code. If your terminal or IDE has Full Disk Access, agents and tools you start there run with it. Apple notes the exact algorithm is undocumented and may change.
Did Meta's Muse read a journalist's messages without permission?
That is disputed. Inc. columnist Jason Aten wrote that Muse synced his Messages database while Full Disk Access showed as off. Meta says Muse cannot read Messages unless the user enables both Full Disk Access and the Messages connector, and that macOS protections cannot be bypassed. It has not been independently verified.
Which AI agent apps ask for Full Disk Access?
Engadget reports that desktop clients for agents such as OpenClaw, Dots and Muse often encourage users to grant Full Disk Access so the agents can reach files, messages and other data.
How do I check which apps have Full Disk Access on my Mac?
Open System Settings, then Privacy and Security, then Full Disk Access. Every app with its switch on has the permission. Pay special attention to terminals and IDEs, desktop agent apps, and the Remote Login setting that can give SSH sessions full disk access.
Should I turn off Full Disk Access for my terminal?
If you run coding agents in it and do not need system-wide reads for daily work, turning it off limits what those agents and their tools can reach. Switch it off, see what breaks, and only turn it back on for a specific task that needs it.
What should developers of desktop AI agents use instead of Full Disk Access?
Apple's documentation describes asking the user to pick a file or folder in a standard open panel, which extends the app's access to that folder and everything inside it, and keeping that access across launches with a security-scoped bookmark. Apple DTS advises asking for Full Disk Access only after a concrete failure, with an explanation.
What does Microsoft's Digital Defense Report 2026 say about AI agents?
It says attackers already treat AI as an attack surface and lists five risk classes for agents, including sensitive data exposure and excessive agency. It reports that 88% of enterprises are experimenting with AI agents and recommends reducing oversharing, least privilege, and treating agents as identities.
Is Full Disk Access only meant for backup apps?
Apple says the permission largely sidesteps its privacy controls so backup apps can work. MacStories pointed out that many non-backup utilities rely on it, such as launchers and file tools, and worried Apple may restrict which apps can use it. John Gruber shared that worry while noting most Mac users do not realize how much it grants.

Sources

S1Apple Developer News, "Updates to Full Disk Access in macOS," October 2, 2026, developer.apple.com
S2Quinn "The Eskimo!" (Apple DTS), "How to grant command line tools full disk access," Apple Developer Forums thread 756510, June 2024, developer.apple.com
S3Karissa Bell (Engadget), "Apple sounds the alarm on AI agents and 'Full Disk Access'," October 2, 2026, engadget.com
S4ghostty-org/ghostty, "macOS Ghostty loses folder access during Claude sessions despite Full Disk Access," Discussion 12947, June 7, 2026, github.com
S5Sarah Perez (TechCrunch), "Apple says it's tightening macOS 'Full Disk Access' controls due to new risks from AI agents," October 2, 2026, techcrunch.com
S6Ana Maria Constantin (The Next Web), "Meta denies its Muse AI agent read a journalist's private messages," September 30, 2026, thenextweb.com
S7Microsoft, "Microsoft Digital Defense Report 2026," October 2, 2026, microsoft.com
S8microsoft/vscode, "macOS: Child processes cannot access TCC-protected resources," Issue 307364, 2026, github.com
S9John Voorhees (MacStories), "Apple Announces Plan to Impose New Full Disk Access Controls on Mac Developers," October 2, 2026, macstories.net
S10John Gruber (Daring Fireball), "Apple Is Going to Further Tighten the Screws on Full Disk Access on MacOS, in Response to Agentic AI Apps Running Amok," October 2, 2026, daringfireball.net
S11Quinn "The Eskimo!" (Apple DTS), "Query related to privacy protection changes in Catalina," Apple Developer Forums thread 121352, 2019, developer.apple.com
S12Apple Developer Documentation, "Accessing files from the macOS App Sandbox," accessed October 4, 2026, developer.apple.com

Written by

Syed Moinuddin

Full Stack Engineer.

Notes on AI tooling, agentic systems, and building things that survive contact with production.