Apple Will Tighten Full Disk Access. Your Mac Still Has the Old Switch.

US X trends on 5 October were football and celebrity. Saints, Joe Mixon, and Monday Night Football sat at the top. Hacker News did not have this story. The Hacker News did. Three days after Apple posted it.

On 2 October Apple told developers that Full Disk Access sidesteps the privacy controls on a Mac, that some developers are using it in ways that expose files, mail, messages, and browsing history, and that the risk grows as AI agents become more autonomous. The additional control is a promise. There is no macOS version and no date.

Medium Medium because the grant is extraordinary and already live, not because Apple reported an incident. There is no CVE in the note.

What Apple actually wrote.#

The primary is Apple's developer note, Updates to Full Disk Access in macOS, posted 2 October 2026. It is four sentences. Full Disk Access exists so backup apps can function, and it largely sidesteps the controls that protect private data. Some developers use it in ways that can expose everything on the system, including files, mail, messages, and browsing history, without users fully understanding that. For communication apps, the other person's privacy is in scope too. Going forward, Apple will add controls so this grant happens only with very explicit user action. The reason is the last sentence: as AI agents become more capable and autonomous, the risks of this access grow substantially.

That is the whole primary. No product name. No incident. No build number.

The Hacker News carried it on 5 October and attached a product narrative Apple did not write: agent apps that ask for the permission, including Meta's Muse, and a local flaw Patrick Wardle reported against Muse's Mac app. Daring Fireball, on the day of the note, already said Apple named nobody. Keep those names in the press pile. They are not findings in Apple's post, and this brief does not repeat anyone's reproduction of a local flaw.

Full Disk Access is not new. Apple's own platform security guide already says apps that need the whole disk are added in System Settings, and that accessibility and automation need their own permission so they do not walk around the other checks. What changed on 2 October is the admission that "the user flipped a switch" is too thin once the app is an agent, plus a commitment to make the flip harder. The commitment has no clock.

Package clock versus impact clock.#

There is no package. Do not go looking for a version to bump.

The vendor clock starts on 2 October and has not ticked. "Going forward, we will introduce additional controls" is the entire ship plan. No beta, no entitlement name, no date. The press clock is 5 October, when The Hacker News wrote it up. That article does not contain a release either.

The impact clock is every grant already on a fleet. A coding agent, a connector, or a "personal" assistant with Full Disk Access can read mail, messages, and browsing history, and can see other people's side of those conversations. That is Apple's description of the current setting, not a forecast about a future model. Waiting for the unnamed control leaves the grant in place.

1. 2026-10-02
   Apple posts the developer note. No product, no macOS version, no date. Daring Fireball notes that Apple named no one.
2. 2026-10-05
   The Hacker News carries the note and attaches agent apps Apple did not name. The tighter control is still unshipped.

What this is not.#

It is not a breach notification and not a claim that Apple Intelligence or Private Cloud Compute was compromised. Apple did not say either. It is not a CVE you can drop into a scanner. It is not a reason to strip Full Disk Access from backup and security tools that cannot function without the whole disk.

It is also not a completed redesign of Mac permissions. Accessibility, automation, and screen recording sit on the same privacy pane and can still widen what an agent does after a person clicks through. Apple flagged the disk grant. It did not retire the others.

The press stories about a specific agent reading messages are context for why Apple wrote the note. They are not a substitute for the list on the Mac in front of you. If the app is not in that list, the writeup does not put it there.

What to do.#

If you run Macs that have coding agents, connectors, or always-on assistants:

1. Open System Settings, Privacy and Security, Full Disk Access. Write down every agent, assistant, and connector. The list is the finding. Apple will not publish it for you.
2. For each one, decide whether the job is backup-shaped. If it only needs a repository or a documents folder, move it to Files and Folders and turn the disk grant off. Expect a feature in that app to break. That is the point of the test.
3. Leave the grant on real backup and security tools, and give it an owner. An unnamed switch from a setup guide is how this permission spreads.
4. Read the rows next to it. Accessibility and automation are how an app drives other apps. An agent that can click and type does not need Full Disk Access to be a problem, and Full Disk Access does not become safe because those rows look quiet.
5. Do not wait for the tighter control. There is no version to schedule. When Apple ships it, the grants you already made are the ones a louder prompt will have to revisit.
6. If the agent can read Mail or Messages, the data includes the other party. That sentence is Apple's, and it belongs in the DPIA language next to agent-executed access, the same way a filing has to name the class.

X Trends this evening were a football slate. Apple's note is four sentences and no date. The switch those sentences describe is already on the machines.