macOS Full Disk Access Changes: What AI Agent Users Should Know

macOS Full Disk Access is facing tighter controls as Apple responds to the risks of increasingly autonomous AI agents. Apple has confirmed that granting this permission will require more explicit action. A November 8 report now describes one possible implementation in macOS 27.3, but the precise interface and release timing remain unconfirmed by Apple.

The distinction matters if you use an assistant that reads files or messages. A change to how an app appears in Settings is not the same as a new, narrowly scoped permission. Nor does an additional manual step make an app trustworthy. Here is what the available evidence establishes, and what Mac users can sensibly do now.

What Apple confirmed about macOS Full Disk Access

In an October 2 developer announcement, Apple said Full Disk Access largely sidesteps privacy controls so that backup applications can work properly. It warned that some developers use the permission in ways that expose files, mail, messages and browsing history without users fully understanding the consequences.

Apple also highlighted a less obvious concern: granting a communication tool access can affect the privacy of people who exchange messages with its user. A conversation includes other people's information, even when the computer belongs to you.

The company committed to additional controls requiring “very explicit user action.” It specifically connected that decision to AI agents becoming more capable and autonomous. However, the announcement did not promise a particular settings layout, name a macOS 27.3 release date or describe a replacement permission for reading only messages.

What the macOS 27.3 report actually says

9to5Mac's November 8 report, citing code researcher pdfu, describes a possible change to automatic listing in the Full Disk Access settings panel. According to that account, a failed attempt to read a protected file currently causes an app to appear as an option in the panel. Developers can then direct users to enable its toggle.

The reported change would stop that failed access attempt from automatically adding the app to the list. Users might instead need to add the application manually. The report says dragging an app into the panel still worked with the relevant feature flag enabled, so it does not establish that broad access is going away.

Treat this as reporting about development behavior, not a guarantee of the final shipping interface. We have not independently tested the feature flag. Apple's announcement supports the broader policy direction, but it does not confirm every implementation detail attributed to the researcher.

Why an extra step does not mean narrower access

Apple's Mac user guide describes Full Disk Access as permission to access files including data from other applications, Time Machine backups and certain administrative settings for all users. It lists Files & Folders separately, along with permissions such as Accessibility, Automation and Screen & System Audio Recording.

Those categories should not be treated as interchangeable. Permission to read broad sets of data is different from permission to control another app or record a screen. An assistant may request more than one category, and reviewing only its most visible toggle can miss part of its access.

Apple's official AI product imagery accompanying this article shows existing assistant experiences, not the proposed macOS 27.3 permission interface. The point of the comparison is that useful personal context and broad disk access are different design choices. A screenshot of Siri is not evidence that a third-party assistant has equivalent privacy protections.

How to review an AI app before granting access

Open System Settings, choose Privacy & Security and inspect Full Disk Access. Apple's guide explains that applications can be added using the add control, selecting an app and opening it. Exact controls can vary with the installed system version, so follow the guide for your Mac rather than a leaked interface description.

Before enabling access, ask what information the particular feature needs, whether a narrower permission is supported and where the application sends the data it reads. Check the developer's own documentation and privacy policy. A request to summarize one document deserves a different evaluation from a backup utility designed to read a disk.

If a tool is no longer used, review the permissions it retains. For a work computer, follow your organization's management policy rather than changing security settings to satisfy an unfamiliar setup prompt. These are practical review steps, not a claim that permission management alone prevents every misuse.

What remains unresolved

The 9to5Mac report also raises the possibility of Private Folders offering more scoped access. It explicitly says details are limited. There is not enough verified information here to promise that an assistant will be able to read only an iMessage database through a new permission.

For now, Apple's confirmed commitment is clearer consent for an extraordinary level of access. The proposed listing change could add friction, but the meaningful test will be whether users understand the scope and whether developers offer less expansive alternatives. Do not install an experimental build solely to obtain a privacy change that Apple has not yet documented as a finished feature.

Sources: 9to5Mac report, Apple developer announcement, Apple Intelligence features and availability, Apple Privacy & Security guide.

Related: Raycast Dictate to AI Adds Voice and Active-App Context.