Full Disk Access is the one macOS permission that does not follow the pattern you expect. Camera access opens the camera, Contacts access opens your contacts, and Files & Folders access covers the folders you pick. Full Disk Access removes the per-app privacy checks for a single app and gives it a system-wide exemption. Reports in October 2026 say Apple is tightening how that grant is approved, and the reason is AI agents. If you run a desktop assistant, a coding agent or an automation tool on your Mac, this change is aimed at a risk you may already be carrying.

01What Full Disk Access actually grants

macOS protects sensitive data through the TCC system, which stands for Transparency, Consent and Control. Every protected resource has its own prompt: an app asks for Photos, you approve it, and that approval covers Photos and nothing else. Full Disk Access skips the model. One toggle tells macOS to stop applying those per-process protections to that app.

The difference is easier to see side by side:

That is why the permission is not a few extra folders. It is the strongest general exemption macOS offers, and it exists for a small set of jobs that genuinely need it, such as backup, sync and disk utilities.

The system enforces the boundary even against your own scripts. Ask for the permission list directly from a normal terminal and macOS refuses:

printf "select client from access where service='kTCCServiceSystemPolicyAllFiles';\n" | \
  sqlite3 "$HOME/Library/Application Support/com.apple.TCC/TCC.db"

Error: unable to open database "/Users/<you>/Library/Application Support/com.apple.TCC/TCC.db": authorization denied

That denial is the point. The database recording every privacy decision is itself protected, so the switch list in System Settings is the record you can trust. If you want the full walkthrough for auditing that list and revoking a grant, the companion guide on auditing Full Disk Access covers it step by step, including how to compare the list over time.

02Why an AI agent makes the grant more dangerous

Traditional apps do a narrow, predictable job. A backup tool reads files and writes a backup. A sync client reads one folder and uploads it. You can reason about what an app touches because its behaviour is fixed.

An agent is different in two ways. It decides its next action from its instructions and from whatever it reads, so its reach is open-ended rather than a fixed list. And the material it reads can steer it: a web page, an email, a PDF or a code comment can carry instructions an agent may follow, which is the prompt-injection problem.

Full Disk Access turns an agent into a whole-disk reader

Combine those two properties and a single grant stops being a convenience. An agent with this exemption can read protected locations you never meant to expose, and a malicious page it reads can point that access somewhere you did not choose.

None of that makes agents unsafe by default. An agent that can read only the project folder you pointed it at is useful and contained. The risk lives in the moment someone grants the exemption just to make permission prompts go away.

03What Apple is changing

In October 2026, reports said Apple is changing Full Disk Access permissions in order to curb abuse from AI agents. According to those reports, the concern is not one specific bug. It is that the grant has been handed to software that exposes far more of a system than the user realised, and that increasingly autonomous agents raise the stakes when they hold it.

Treat the coverage as direction rather than a detailed changelog. Reports describe a move toward an approval that is harder to get by accident, so that granting this access becomes a deliberate action instead of a click you forget. The visible effect for most people is likely to be new or repeated permission prompts around this permission after an update.

New prompts only help if you check the old list first

If Apple asks you to re-approve access, you will be deciding under pressure. Knowing which apps already hold the grant today makes that decision a comparison instead of a guess.

04How to check which apps have Full Disk Access

You can review the current state in a few minutes. The goal is to know every name on the list, not just the ones you remember adding.

1. Open System Settings, then go to Privacy & Security, then Full Disk Access.
2. Read every entry. Apps you installed months ago are the ones most likely to be forgotten, and they are exactly what a tightening is meant to surface.
3. Check Login Items & Extensions under General. Vendor helpers and background items can run on behalf of an app, so the visible app is not always the whole picture.
4. Look at agents and developer tools specifically. Terminals, code editors, note apps and automation utilities are where an agent is most likely to run.
5. Re-check after a major update. A grant is tied to the app's code signature, so a properly signed update usually keeps it while the app's behaviour may have changed.

Take a screenshot of the list, or paste it somewhere you will find again. When the next permission prompt arrives, a two-minute comparison tells you whether the request is new or whether you already approved something broader.

05Where an AI agent inherits the grant

A common misunderstanding is that the agent has to be on the list itself. Permissions belong to the process that asks, and child processes inherit their parent's access. That produces a few patterns worth knowing:

The first row is the one that catches people. Granting Full Disk Access to a terminal for one annoying task quietly gives every future command and every agent you launch there the same reach.

06How to decide before you press Allow

Work through these in order and stop at the first one that solves the problem:

• Ask for the folder, not the disk. Files & Folders access covers a project directory and leaves everything else protected.
• Run the agent inside a boundary. A container, a virtual machine or a separate user account contains a mistake without needing you to manage permissions at all.
• Keep the grant off your terminal. Run one-off tasks from a shell that does not hold the exemption, or use a dedicated tool with scoped access.
• Grant only to software whose job is inherently system-wide. Backup, disk repair and system monitoring qualify. A chat client or a launcher usually does not.
• Revoke what you no longer use. Remove grants for apps you have uninstalled or replaced, then re-check the helper processes they left behind.

Isolation beats permission management

If an agent only ever sees one folder, you do not have to predict what it will read. A sandboxed agent that is compromised reaches a single project instead of your Messages history.

07Common mistakes and fixes

Full Disk Access is not evil, and the apps that genuinely need it are doing real work. What makes it worth your attention right now is the combination the reports describe: a permission designed for system utilities, handed to software that acts on its own, while Apple moves to make that hand-off more deliberate. Check the list once, and the next prompt becomes a decision you make rather than one you click through.