Apple stops AI agents in macOS by limiting disk access after it was revealed that Meta was reading private messages

Apple Macs are the favorite computers to run local AI and have agents that work in the background. And that has a lot to do with what the company has announced. Apple is proposing a major change to macOS privacy policies to prevent third-party tools, especially AI agents, from accessing private user content.

The decision, according to Ars Technicacomes after the controversy that arose over the assistant Muse de Meta. This generated alerts based on a user’s private conversations without their explicit authorization. Given this situation, Apple will restrict the scope of full disk access in your operating system to shield personal communications.

What Meta vs. what researchers say

The incident became known after a journalist reported that Meta’s assistant sent him a notification making direct reference to a talk held via the Messages app.

In response to his post, Meta’s chief technology officer, David Singleton, denied any technical violation and assured that the assistant only queries data if the owner enables two independent permissions. According to the manager’s version, Meta claimed that the integration requires activating a specific connector within the tool itself, in addition to macOS disk permission.

However, this explanation was quickly refuted by macOS security specialist Patrick Wardle. The analyst argued that granting full disk access privilege removes any technical barrier, allowing any process to read files without privileges. rootsuch as chat databases, browsing histories and cookies.

For the research community, the permission grants indiscriminate reading of any local file regardless of the visual selectors that the application displays in its interface.

Apple takes the side of the user

In this scenario of contrasting versions, Apple has publicly intervened. The Cupertino company has warned that delegating such broad reading powers to automated assistants compromises the privacy, even of other users outside of the team itself. In fact, that’s exactly what happened when Muse read the messages involving third parties.

To justify the imminent redesign of this security layer, the company published a statement to developers:

“We offer developers powerful APIs to integrate incredible features into their applications for Apple products, backed by a set of controls designed to protect users’ private data. Full Disk Access largely bypasses these controls to allow backup applications to function properly on Mac. Some developers use Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without their full knowledge or understanding. In the case of communication applications, this can also compromise the privacy of the people with whom users communicate.

Going forward, we’ll implement additional controls to ensure that users who actually want to grant an app this level of exceptional access can only do so through explicit action. Addressing this issue is essential. As AI agents become more capable and autonomous, the risks associated with this level of access will increase significantly. “We are committed to ensuring that users clearly understand these risks before granting such access, so that they can make informed decisions about their data and privacy.”.

With this positioning, Apple stressed that the autonomy of agents amplifies the risks for the user and their contacts. Furthermore, it makes it clear, without directly pointing out Meta, that some companies take advantage of disk access permission indiscriminately, when it is really designed for very specific tools, such as backups. It also promises to make clear what permissions are actually being granted to apps, so users really know what the implications are.