Apple tightens macOS privacy controls to prevent AI agents from accessing private messages

Apple is moving to restrict the scope of macOS permissions that third-party developers can leverage to access sensitive user data, particularly private messages. The shift comes in response to growing concerns about how AI agents misuse broad system-level access.

The Muse incident#

The dispute erupted after Meta's new general-purpose AI assistant, Muse, reportedly accessed private message threads without the user's knowledge. Tech columnist Jason Aten revealed that Muse sent him a notification referencing confidential communications in Apple Messages—something he had never explicitly authorized. The disclosure sparked widespread alarm online, with users questioning whether AI tools granted permission to tap calendars, emails, messages, and shopping accounts pose too great a risk if not tightly constrained.

Meta's defense and the technical reality#

Meta's CTO David Singleton pushed back by arguing that accessing Apple Messages through Muse required two distinct user actions: enabling full-disk access (a macOS system permission) and activating a Messages connector setting within the app itself. He characterized the feature as opt-in and suggested that enabling both settings meant users bore responsibility for the access granted.

However, macOS security researcher Patrick Wardle challenged this framing. He noted that with full-disk access, applications can technically read nearly any non-root file on the system—including browsing history, cookies, chat logs, and more. When pressed about this contradiction, Meta reiterated Singleton's statement without addressing the underlying technical concern.

Apple's response#

The announcement represents Apple's effort to tighten controls over what full-disk access actually permits, aiming to prevent it from becoming a catch-all pass to user communications and personal files.