macOS: Apple Restricts Disk Access for AI Agents

Apple is preparing a revision of the "full disk access" permission in macOS to regulate uses deemed risky for personal data. The announcement comes after reports concerning Meta's Muse agent and as the company highlights the increasing risks associated with more autonomous AI agents.

Muse Targeted by Security Alerts and a Block by Amazon

Eleven days before Apple's announcement, Patrick Wardle described a configuration that allows any application or code running on a Mac to take full control of Muse, subsequently accessing the same resources as the assistant. Meanwhile, Amazon removed Muse from its platform, stating that these applications must operate transparently and respect service providers' decisions regarding their participation. Apple did not name Meta or Muse in its communication, and no other cases of applications improperly reading messages or browsing histories via full disk access are known. Meta's communications department did not respond to questions posed on Friday.

Apple Revises Full Disk Access Permission

Apple plans to adjust the privacy settings in macOS related to full disk access to limit abuses. The company aims to prevent this permission from being used to read message histories without users' clear understanding. Apple claims that some developers expose files, emails, messages, and browsing histories, and that for communication applications, this can affect the privacy of correspondents. The company anticipates a significant increase in risks as AI agents become more capable and autonomous, and it wants to ensure that users understand these issues before granting such access.

Meta Conditions Message Reading on Two Settings

David Singleton, CTO of Meta, asserts that Muse can only read the content of Apple Messages if two conditions are met by the user: full disk access at the system level and the activation of a Messages connector in the app, an integration presented as optional. This position has been challenged by expert Patrick Wardle, who reminds that with full disk access, any non-root file becomes readable, including discussions and browsing data. When questioned on this point, Meta's communications department reiterated Singleton's explanations. Apple's statements regarding the risks associated with this permission seem at odds with the claim that Muse could not read Messages without an active connector.

Initial Incident and Public Debate on AI Assistants

The change announced by Apple comes two weeks after columnist Jason Aten received an unsolicited notification from Muse referencing a conversation held in Apple Messages. He claims he never granted the AI agent permission to read his messages and believed they were inaccessible. The incident sparked a lively online debate: many internet users compare assistants that access calendars, emails, messages, or shopping accounts to powerful tools that are useful but potentially dangerous. It is possible that Apple's statement was not aimed at this specific incident, although its timing, following significant social media agitation, makes a connection plausible. Some have interpreted these elements as questioning the legitimacy of the extensive access required by Muse, while recommendations urge users to configure permissions cautiously, despite the limitations shown by the reported experience.