The full disk access permission is something you give to backup software.

If you give full-disk access to Meta software running on your main computer, Meta is not going to respect your privacy.

> Friday’s [full-disk access] announcement comes two weeks after tech columnist Jason Aten said that Meta’s new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permissions to read his messages and had assumed they were off-limits. Social media last week blew up with masses of people who agreed and said the incident showed that AI assistants given access to calendars, emails, messages, shopping accounts, and other resources are akin to a skill saw or other power tool. While potentially useful, they can do real damage if not used carefully.

https://arstechnica.com/security/2026/10/apple-changes-full-...

> The question, however, is whether what they are designed for is the future I am barreling towards, one where agentic abstraction both renders traditional interfaces relics

I think he was burying the lede but glad he finally posed the question.

I think it's a bigger risk factor for Apple than is generally assumed. If consumers get used to the freedom but endemic spying of products like Muse, Apple may have a hard time sticking to their privacy and security mandate.

> This system is annoying but manageable on your primary Mac; it’s a disaster on a headless Mac running agents, for two reasons. First, agents write new programs all of the time, and in my case, those programs need access to devices on my network (SMB shares, for example, trigger a TCC warning). What I need is a permission layer for agents, not the programs they create; TCC is operating at the wrong level of abstraction.

Doesn’t that already exist? If I give Terminal.app access to the entire disk, CLI tools started by the app (indirectly: Terminal.app runs a shell, and the shell runs the tools) have that access, too.

And I don’t think that’s because Apple gives Terminal.app preferential access. Google tells me that works for iTerm, too.

Or would it mean agents need to do some special thing to launch tools?

The vuln required "port 5900 was accessible from the Internet"

Why would anyone open up random ports (or even all ports) to the internet?

Couldn’t you give agents access to the screen sharing software to see the TCC prompts?

I feel like this article was all over the place. Also, this person was really running a macOS box raw on the Internet, no firewall, nothing? :/

> Apple doesn’t seem too happy about agents

I don't get this reaction to Apple making Full Disk Access more explicit. Whether they're "happy" or "sad" about agents doesn't seem responsive at all.

Kinda seems like whenever you spend 10 seconds thinking about the average user, social media gets angry. The quoted justification by Apple seems reasonable.

It is not about emotion; it is about platform control. Apple limits background autonomy under the label of security, while ensuring only their first-party system frameworks get unfettered ambient access. Standard playbook.