Apple said on October 2 that apps will get Full Disk Access on macOS only after very explicit user action, and named AI agents as the reason. A leaker says macOS 27.3 beta code stops apps from appearing in the Full Disk Access list on their own. Apple has not confirmed that detail or a ship date.
Apple is tightening how Mac apps get Full Disk Access, the permission that lets an app read almost everything on your Mac, and AI agents are the reason it gave. If you have granted that access to an agent app, check your list now. Apple confirmed the direction in October. The first concrete change reportedly sits in the macOS 27.3 beta, but Apple has not confirmed it.
What Apple confirmed
On October 2, Apple posted Updates to Full Disk Access in macOS on its developer news site. Apple says it “will introduce additional controls” so that users can grant the permission only with “very explicit user action.” It names AI agents and says the risks of broad file access “will grow substantially.” The post gives no version number, date or technical detail.
Full Disk Access lets an app get around many of macOS’s privacy protections, including the folders that hold Mail, Messages and Safari data. That is why agent apps that want to read your messages or files ask for it.
Apple released the first iOS and macOS 27.3 betas on November 3. Apple’s announcement of those betas does not mention Full Disk Access.
What the 27.3 beta reportedly changes
A leaker who posts as pdfu on X said on November 7 that macOS 27.3 beta code changes how apps reach the Full Disk Access list, according to 9to5Mac. Here is the reported change:
- Today: when an app asks for a protected file, macOS denies the request and adds the app to System Settings > Privacy & Security > Full Disk Access with its toggle off. The app then tells you to go flip it on.
- Reportedly in 27.3: the denied request is no longer logged, so the app does not appear in the list. You would have to add it yourself, for example by dragging the app into the Settings pane, which still works.
9to5Mac says the change sits behind a feature flag and is still in development, so it may not ship in 27.3 or may ship in a different form. pdfu also mentioned “Private Folders” as a possible narrower alternative. 9to5Mac calls that unclear. The outlet adds that developers mostly want Full Disk Access to reach the Messages database. Apple has not said whether it will offer access to just that folder.
Confirmed vs. reported
Confirmed by Apple: new controls are coming, they will require explicit user action, and AI agents are the stated reason. Reported by one leaker through 9to5Mac and not confirmed: the beta behavior, the 27.3 timing and Private Folders. 9to5Mac had already warned readers in September not to give Meta’s Muse app access to their Mac. Muse is one of the consumer agents now competing with Claude Duet and others.
What to do now
- Audit the list today. Open System Settings > Privacy & Security > Full Disk Access and turn off any app you don’t recognize or no longer use. An agent app does not need it to answer questions in a chat window.
- Give agents the narrowest access that works. If an app only needs one folder, use the Files and Folders permission instead. If it needs your accounts, a broker such as 1Password’s agent sign-in avoids handing over everything.
- If you ship a Mac app, plan for a manual step. If the reported change ships, onboarding that waits for the app to show up in Settings will break. Add a clear “drag the app into this list” instruction now.
- If you manage Macs, wait for Apple’s documentation. Apple has not said how the new controls interact with managed privacy profiles. Don’t change MDM policy on a beta report.
Agent apps lose the easy path to your messages
Our read is that the cost lands on agent makers. The easiest way for an agent to read your iMessages has been a single toggle that macOS put in front of you. Apple’s October wording says that toggle is going away for apps that ask casually, and the beta report shows one way it could happen. For a founder running an agent on a work Mac, that is good news: anything with access to your messages will have had to ask you on purpose. Expect agent apps to push Apple’s own routes, like App Intents for Siri, or narrower folder access instead.