{"id":3379,"date":"2026-10-05T11:26:10","date_gmt":"2026-10-05T11:26:10","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3379"},"modified":"2026-10-05T11:26:10","modified_gmt":"2026-10-05T11:26:10","slug":"apple-plans-tighter-macos-full-disk-access-controls-over-ai-agent-data-access","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3379","title":{"rendered":"Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Access"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 05, 2026<\/span><\/span>Vulnerability \/ Artificial Intelligence<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Apple has announced that it’s taking steps to tighten controls around a macOS setting called Full Disk Access (FDA) due to security risks posed by artificial intelligence (AI) agents.<\/p>\n

\u00abSome developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems\u2014including files, mail, messages, and even browsing history \u2013 without users’ full knowledge and understanding,\u00bb Apple said<\/a> in a post. \u00abFor communication apps, this can also compromise the privacy of the people users are communicating with.\u00bb<\/p>\n

Full Disk Access<\/a>, accessed via Privacy & Security in the Settings app, was introduced by Apple in macOS Mojave (version 10.14), offers users greater control over which applications can access their entire system and data from apps like Mail, Messages, Safari, and Time Machine backups.<\/p>\n

Once the setting is enabled for an application, it allows that program to bypass certain security restrictions and read and write to system files that apps are typically restricted from accessing or modifying. This option is essential for apps, such as security tools and backup software, that require deep system access to function properly.<\/p>\n

Stating that Full Disk Access largely bypasses controls designed to safeguard users’ private data, Apple said it plans to introduce updates to the setting to ensure that this sort of access is granted only with an explicit user action. It’s currently not known when the new controls will be rolled out.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abAs AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially,\u00bb Apple added. \u00abWe are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.\u00bb<\/p>\n

<\/p>\n

Although Apple did not take any specific name, the development appears to be a response to a recent report about how Meta’s Muse<\/a> agentic tool accessed a journalist’s private iMessages after they<\/a> granted<\/a> it Full Disk Access. Muse is advertised<\/a> as a \u00abpersonal AI agent\u00bb built along the lines of OpenClaw that runs on a dedicated Linux virtual machine on Meta’s cloud.<\/p>\n

Meta has since clarified that, for Muse to be able to access a user’s private messages, it must have two permissions: have Full Disk Access and have a Messages connector setting in Muse enabled.<\/p>\n

\u00abThe Messages integration in the Muse Mac app is opt in,\u00bb Meta CTO David Singleton said<\/a>. \u00abYour Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled.\u00bb<\/p>\n

Apple’s announcement also comes weeks after security researcher Patrick Wardle demonstrated a proof-of-concept (PoC) exploit for a zero-day in Muse’s Mac app called not-a-mused that allows any app or terminal command to obtain access to the token that authenticates users to their Muse account.<\/p>\n

The now-patched vulnerability \u00abcan let an unprivileged local process redirect Muse’s dictation traffic and abuse the trust\/access granted to the app,\u00bb Wardle said. \u00abThe concern is that Muse may have significantly broader access than ordinary local malware, making it a particularly useful target for privilege\/access amplification.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Specifically, a local attacker can exploit an undocumented setting named \u00abendo_voyager_dictation_endpoint\u00bb without requiring any special privileges, allowing them to capture dictated audio and prompts, inject malicious prompts, and abuse the access Muse has been granted for other malicious actions.<\/p>\n

Wardle has also been acknowledged<\/a> for reporting another vulnerability<\/a>, tracked as CVE-2026-100754<\/a>, impacting OpenAI’s ChatGPT app for Mac that could have been abused to take over the AI assistant and grant an attacker unauthorized access to chat logs and other data stored by the app.<\/p>\n

These findings demonstrate how the privileged position<\/a> enjoyed by agentic tools, the extensive data they collect<\/a>, and their ability to interact with various parts of the operating system, like writing files to disk, accessing the mic and camera, creating calendar events, sending emails, and monitoring location, can expand the attack surface and open the door for an adversary to abuse this access and steal sensitive data. <\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Oct 05, 2026Vulnerability \/ Artificial Intelligence Apple has announced that it’s taking steps to tighten controls around a macOS setting called Full Disk Access (FDA) due to security risks…<\/p>\n","protected":false},"author":1,"featured_media":3380,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[130,683,618,1780,38,2450,753,421,3617,3658],"class_list":["post-3379","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-access","tag-agent","tag-apple","tag-controls","tag-data","tag-disk","tag-full","tag-macos","tag-plans","tag-tighter"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3379","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3379"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3379\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3380"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3379"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3379"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3379"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}