Apple said in early October 2026 that it will introduce new privacy controls on Mac against artificial-intelligence agents after user complaints that Muse — Meta’s personal agent launched the prior month — may have accessed private messages. On its developer site, the company said full disk access will be granted only “with very explicit user action.”
Full Disk Access is the macOS permission backup tools and some legitimate utilities use to read nearly all data on the volume. With desktop-resident agents, that same switch becomes a master key to messages, contacts, photos, mail and browsing history.
The media trigger included columnist Jason Aten’s account that Muse notified him about his messages without his having granted permission to read them. Meta, via spokesperson Andy Stone in later coverage, said Muse needs both Full Disk Access and a Messages connector to read messages — a technical defence that did not calm perceptions of opacity.
Apple set no rollout date and did not name Muse as the sole cause, but the calendar leaves little room for coincidence: the announcement followed the complaint wave by days and landed the same week Muse system-prompt leaks fed another safety scandal. The change will also apply to third-party apps.
The immediate precedent is July 2026, when Meta pulled Muse Image days after launch over automatic Instagram account linking without clear consent. Muse as a personal agent sought to reset the narrative; instead it inherits suspicion that Meta prioritises agent usefulness over granular consent.
For Mac agent developers, the normative message is clear: a dark toggle in System Settings will not suffice. They will need intelligible permission flows, justify why full-disk access is required and, whenever possible, use scoped APIs (Messages only, Photos only) instead of the full-disk wildcard.
The episode fits the wider platform war to be the “agent operating system.” Apple controls the silicon and the permission; Meta controls social distribution and a free agent that hit number one on the U.S. App Store. When they collide, users feel the conflict as an unexpected notification about their private life.
California and EU regulators are watching. If Full Disk Access becomes the default vector for desktop agents, data-protection law will demand clear legal bases and minimisation. Apple’s redesign may get ahead of obligations that would otherwise arrive via sanction.
Enterprises deploying internal agents on Mac fleets should already inventory which binaries hold Full Disk Access, revoke unnecessary grants and demand connector documentation from vendors. A productivity agent with full-disk rights is, in practice, a silent administrator.
Neural Pulse does not claim Muse exfiltrated data to Meta servers in the reported cases; it claims the perception of non-consensual access was enough to move Apple. The distinction matters legally and journalistically.
Meta had not, in immediate coverage, issued a detailed technical post-mortem comparable to OpenAI’s agent-incident write-ups. The lack of a chronological explanation — which permission was shown, when, on which build — keeps the grievance alive.
As of 4 October 2026, the only operational certainty is that macOS is preparing to treat AI agents as a class of app that requires conscious friction before opening the entire disk. That friction is a privacy feature, not a usability bug.
MDM vendors (Jamf, Kandji, Intune) should prepare profiles that limit Full Disk Access by default on corporate fleets and log exceptions. Apple’s change will be easier to meet if the policy already exists.
Home users can today review Settings → Privacy & Security → Full Disk Access and revoke what they do not recognise. That five-minute inventory beats any agent productivity tip.
If Meta wants trust back, a public technical timeline — permissions requested, screens shown, builds affected — is the minimum. Silence lengthens the crisis.
