Apple to Tighten macOS Full Disk Access Controls Over AI Agent Misuse

Overview

Apple is addressing a significant security risk on macOS related to the Full Disk Access (FDA) permission. Certain AI agents are leveraging FDA in ways that grant them overly broad access to user data, including personal files, emails, messages, and browsing history, often without the user’s full understanding. This initiative aims to close a potential privacy and security gap that could lead to widespread data exposure.

Technical Analysis

• Vulnerability: Misuse of the macOS Full Disk Access (FDA) permission by applications, specifically AI agents.
• Mechanism: FDA is a legitimate macOS security feature designed to allow applications (e.g., backup software, antivirus) to access protected user data directories.
• Exploitation: Developers of some AI agents are requesting and receiving FDA, which then grants their applications unrestricted access to sensitive user data across the system. This access includes /Users/<username>/Library/Mail, /Users/<username>/Library/Messages, Safari history, and other personal files.
• Prerequisites: The user must grant FDA to the AI agent application. The core issue is that the scope of this permission is often not fully understood by the user, and the application may not explicitly inform the user about the full extent of data it will access.
• Impact: Unauthorized access to sensitive user data, potential for data exfiltration, privacy violations, and compromise of system integrity if the AI agent is malicious or compromised.

Detection

• Monitor macOS unified logs for TCC (Transparency, Consent, and Control) database changes related to FDA grants, if available via EDR or audit logs.
• Review tccutil output or TCC.db for applications with kTCCServiceSystemPolicyAllFiles permission.
• Behavioral analysis of applications granted FDA: look for unusual file access patterns, excessive reads from sensitive directories (e.g., mail, messages, browser history), or network connections to untrusted destinations.
• Endpoint Detection and Response (EDR) solutions can track process activity and file access by applications with FDA.

Sigma Detection Rules

macOS Application Accessing Sensitive User Data Directories

title: macOS Application Accessing Sensitive User Data Directories
id: 5a8b3c2d-e1f2-4a3b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects applications accessing sensitive user data directories on macOS, potentially indicating misuse of Full Disk Access by AI agents or other applications.
logsource:
  product: macos
  service: file_access
detection:
  selection_mail:
    TargetFilename|contains: '/Library/Mail/'
  selection_messages:
    TargetFilename|contains: '/Library/Messages/'
  selection_safari_history:
    TargetFilename|contains: '/Library/Safari/History.db'
  condition: 1 of selection_*
level: high

Mitigations

1. Review FDA Grants: Regularly audit applications listed under System Settings > Privacy & Security > Full Disk Access. Revoke FDA for any application not explicitly requiring it or for those whose purpose does not justify such broad access.
2. Exercise Caution with AI Agents: Be highly selective when installing and granting permissions to AI agent applications, especially those requesting FDA. Understand the data access implications before approval.
3. Monitor for Apple Updates: Apply macOS security updates promptly as Apple implements tighter controls around FDA and AI agent data access.
4. Least Privilege: Adhere to the principle of least privilege for all applications. Only grant necessary permissions.
5. Data Minimization: Limit the amount of sensitive data stored locally where possible, especially if using applications that require broad system access.

References

• https://thehackernews.com/2026/10/apple-plans-tighter-macos-full-disk.html

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1083 — File and Directory Discovery