MANY MINDEDApple tightens macOS permissions to limit AI-driven data access risks
Apple published a macOS update on October 2, 2026, that restricts full-disk access permissions to prevent third-party apps from misusing system-level data. The change specifically targets risks where AI agents could access user information without explicit consent—a concern highlighted by Meta’s Muse AI incident. Jason Aten reported receiving unsolicited Messages notifications from Muse despite never granting it permission to read his history. Meta’s CTO, David Singleton, claimed Muse requires both full-disk access and Messages connector enablement to access Messages, but security expert Patrick Wardle questioned this assertion after disclosing a Muse configuration vulnerability that granted full system control. Apple’s update followed Amazon blocking Muse from its platform due to opaque access practices and came 11 days after Wardle’s vulnerability disclosure. Crucially, Apple did not name Meta, Muse, or specific developers in its announcement.
The update addresses a critical friction point in digital abundance: the growing threat of AI agents bypassing user consent to access sensitive data. By limiting full-disk permissions, Apple aims to reduce the risk that AI tools could exploit system-level access to disrupt free digital services—such as messaging, cloud storage, or financial apps—without users realizing it.
This move strengthens digital trust for services that could otherwise become gated by privacy breaches. When users can safely access tools without fear of unauthorized data extraction, more people gain reliable, free digital resources. However, the change does not specifically resolve the Muse incident, Meta remains unresponsive to Apple’s inquiries, and the timing coincided with social media backlash over AI access risks. What matters next is whether Apple’s restrictions effectively block third-party AI misuse without inadvertently blocking legitimate tools—especially as Meta’s Muse continues to operate on platforms like Amazon where access practices remain unclear.
Source: Ars Technica