Apple will make Mac users take 'very explicit' action before AI agents get Full Disk Access

Apple's change applies at the moment a user consents. By Apple's own description, Full Disk Access can expose files, emails, messages and browsing history because it bypasses the safeguards that normally protect app data ^[3]. Crypto Briefing's assessment is that Apple is not bringing the iPhone's sandbox to the Mac. It is only adding friction and transparency at the point where the user grants access ^[6]. On iPhones and iPads no app can read inside another by default. The Mac keeps Full Disk Access so that tools such as cloud backup services can read everything with the user's permission ^[10]. As far as the post describes, a user who completes the new step will give an agent the same reach as before ^[2].

How much that matters depends on what ships. Suppose the control is a sterner dialog box. Then an agent that already asks for two opt-ins, as Meta says Muse does ^[5], loses some users at one more screen and carries on. A multi-step process placed deep in System Settings would push broad-access agents on the Mac back toward the people who already install backup software. A third possibility is a regulator copying the design into its rules, which would make Apple's prompt the template for agent consent beyond the Mac.

I'd expect the first. Apple described the change as "additional controls" for users "who genuinely wish to grant an app this extraordinary level of access" ^[2]. That wording keeps the permission available. The counter-case is that friction caps access anyway. Muse's pitch is cancelling unused subscriptions and haggling for better prices ^[7], and that work depends on reading the inbox and the message history. An agent that loses a large share of users at the consent screen has lost most of its use on the Mac.

On who sets the first rules, the sources favour the platform owner. The governance positions cited alongside the story are advice. The World Economic Forum proposes an Agent Capability and Authorization Profile that defines what an agent can access and do ^[15]. PwC says companies should manage agents like a digital workforce, with task-based access and limits on what they do on their own ^[16]. The OECD says more work is needed before agentic systems can be considered trustworthy ^[17].

The money at stake is growing fast. Gartner forecasts cited by Cryptopolitan put investment in AI models and platforms at $64.3 billion in 2026, up from $39.3 billion in 2025 ^[12]. That is $25 billion more, an increase of about 64% ^[20]. FTI Consulting found that 60% of large enterprises had slowed, stopped or postponed AI deployment over reputation, regulation and trust ^[18]. A SAS survey put trust in agentic AI at 66%, 10 points below the 76% for generative AI ^[19][21].

The complaint that set this off is disputed. Jason Aten, a technology columnist at Inc, said Muse read private messages on his Mac although he had not enabled Full Disk Access ^[11]. "You have to enable both Full Disk Access and the Messages connector for Muse to be able to read your Messages content," Meta spokesperson Andy Stone wrote on X. "It can't read your Messages unless you do this. And it can be revoked at any time." ^[5] Apple declined to comment beyond its post ^[9]. The post as reported does not say when the controls arrive or what the new prompt will look like ^[2].

I think Apple is raising the cost of consent without capping reach. That view is wrong if the shipped controls limit what a granted app can read, for instance by keeping Messages or Mail out of Full Disk Access unless the user approves each one separately.