Apple Tightens Mac 'Full Disk Access' Because of AI Agents: Agents on Employee Computers Are a New Risk

AI agents no longer run only in the cloud; they also run on employees' own computers. To do their work, these agents want access to files, email and messages. A dispute last week showed how broad that access can be.

What happened

• Inc. columnist Jason Aten wrote that Meta's Muse app knew the content of his private messages even though he believed he had not given it permission.
• Meta CTO David Singleton said the Messages integration is opt-in and requires users to manually enable both macOS Full Disk Access and a Messages connector in the app.
• Citing new risks posed by AI agents, Apple announced it will require much more explicit user action before apps get Full Disk Access.
• According to macOS security expert Patrick Wardle, an app granted Full Disk Access can read most user files, including private chats, regardless of in-app settings.
• Wired reported that a flaw in ChatGPT's Mac app could also have let attackers reach sensitive data.

What it means for companies

When an employee installs a desktop AI agent on a work computer and grants it Full Disk Access, that agent can read company email, documents and messages. That data can travel to the model and provider behind the agent. Most companies don't even know it is happening.

Four safeguards

• Inventory: know which AI apps and agents are installed on company computers.
• Device management (MDM): restrict broad permissions like Full Disk Access through central policy.
• Approved channel: give employees an approved way to use AI where it is known where the data goes.
• Awareness: explain clearly to employees what apps requesting broad permissions can access.

The remot angle

The most effective alternative to employees turning to uncontrolled desktop agents is to give them a safe, convenient approved path. remot routes a company's AI usage through a single controlled layer: sensitive data is masked before it reaches a model, which team may use which model is defined, and every call is logged.