Let’s talk about the Mac setting that let an AI read a man’s private messages — and why the fix is the most important thing Apple said this year.
Here’s the scene. A columnist sits down at his Mac, opens Meta’s Muse — the agent that picked up half a million users in its first week — and asks it something ordinary. It answers. And somewhere inside that answer is proof it has read his private messages. The ones he never gave it permission to touch.
He hadn’t ticked a box. He hadn’t flipped a switch. He just had the app.
Now picture how the machine got in. Not through a breach. Through a setting called Full Disk Access.
On the second of October, Apple published a short post for developers and quietly said the thing most people in this industry won’t. Full Disk Access exists so that backup tools can work. That’s it. It was built for the one piece of software that copies your disk. Somewhere along the way, AI agents started asking for the same permission — because an agent that can read everything is a very capable agent, and an agent that can read one file is a demo.
Apple’s own words: some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems without users’ full knowledge and understanding. Going forward, they say, anyone who genuinely wants to hand an app that extraordinary level of access will have to do it through very explicit user action.
Good. That’s the right direction. And notice what pushed them to it. Two things. The Muse story above. And a Wired report that a flaw in ChatGPT’s Mac app could have let hackers pull sensitive data off the machine.
So a company that keeps a wall around your phone just admitted the wall on the desktop had a door in it. And the door was labelled backup.
Let’s be plain about the mechanics.
Full Disk Access isn’t a wall. It’s a switch. On or off. Give an app that permission and it can read your files, your mail, your messages, your browsing history. There is no “read this folder, this week, for this task.” There’s the whole house, handed over at the front door.
And the thing walking through that door is no longer a program that does exactly what it was coded to do. It’s a model that decides what to do next. So the permission you granted for one job becomes authority over every file in the room.
Most coverage will file this under Apple security. Meta disputes the messages thing. Apple is patching a permission. Move on.
Wrong frame.
The failure here isn’t that one agent misbehaved. The failure is the shape of the permission itself. We built a decade of “allow or don’t allow,” a binary, and we pointed it at software that is now autonomous, persistent, and quietly working at two in the morning while you sleep.
An all-or-nothing switch was survivable when the thing on the other side was a photo editor. It is not survivable when the thing on the other side makes its own decisions.
What people are missing is this: Apple is right, and it’s still not enough.
The fix on the table is more friction before you grant the permission. A sterner warning. A firmer click. That cuts down accidental grants. It does nothing about the ones you grant on purpose that then do more than you meant. It does nothing about an agent that has your full disk today and gets new instructions tomorrow. And it does nothing about revocation — you granted it once, in a moment, and now the grant sits there. Live. Sitting in an architecture you don’t control.
Here’s the uncomfortable part, for everyone building this, including the people who sign my invoices.
A boundary that lives inside the thing it’s supposed to bound is not a boundary. It’s a preference. If the only thing standing between an agent and your whole life is a checkbox the agent’s own developer wrote, then your consent is a suggestion and the agent’s good behaviour is the actual policy.
Good behaviour is not a security model. It’s a mood.
So what should this look like, for real?
Access scoped to the task, not the tool. The agent gets the folder it needs, for the job it was asked to do, for as long as the job takes — and then nothing. Not my entire disk because someone found convenience.
Access that expires by default, so that staying inside my life is a decision I keep making, not one I made once and forgot.
And access granted to the agent’s own identity, not to mine. If my agent does something wrong, I want to see exactly which agent, holding which grant, at which hour, did it. Right now the answer is usually “your account did it.” The machine is wearing my face to cover its tracks.
And a record that lives somewhere I can read without asking the vendor for permission first.
None of that is exotic. It’s how you’d build a bank vault. It’s just not how we built the settings panel, because the settings panel was designed for a world where software did what you told it.
The operator lesson isn’t only for people who write code.
Go look at what you’ve actually granted. Not what you agreed to in principle. What is switched on right now, on the machines that hold your work and your private life. The agent you installed to save an hour a day. The extension that asked for “all sites.” The app that wanted your whole disk so a backup would be tidy.
Most people have never looked. That’s the exploit. Not a broken line of code. The fact that nobody reads the room before handing over the keys.
I’m not against the agents. I shipped mine. The whole point of them is that they can act for you, and that means they need to touch things. Capability was never the problem.
The problem is that we let “capable” mean “unlimited,” and we let “unlimited” mean “permanent,” and we let “permanent” mean “the vendor decides when it ends.”
A permission is the smallest unit of trust a machine can hold. We’re issuing them like light switches, to something that never gets tired and never forgets what it saw.
Scope it. Time it. Name the agent that holds it. And keep the record yourself.
Then you can let it in — and still be the one who decides what it’s allowed to know about you.
You’ve got this.