On October 3, 2026, Beijing time, Apple has announced that it will add controls to full disk access permissions in macOS in the future, requiring users to grant applications this permission with a very clear active operation. The announcement was issued by Apple on October 2 and is aimed at Mac application developers and users who make licensing decisions. Apple has not yet stated when the new controls will go online, nor has it announced the corresponding macOS version, testing schedule, or phased rollout plan. Therefore, the current progress is that the direction of the platform has been determined, and specific measures are still to be released.
High authority scope and platform judgment
Full disk access is different from normal permission which only reads a folder. Apple said this permission would largely bypass the usual controls in place to protect private data and is intended to allow backup apps to work properly. Apps that gain permission may have access to files, emails, messages, and browsing history on the device. Apple did not say that only backup software can apply, nor did it announce that other categories of applications would be prohibited from using it; this announcement is aimed at the risks that arise when the scope of authorization is too large and users do not understand enough.
Apple also included the privacy of communication partners in the explanation: when a communication application obtains widespread disk access, the risk not only involves the Mac user who made the authorization, but may also extend to the people with whom the information is exchanged. The company believes that the continuous improvement of the capabilities and autonomy of AI agents will significantly increase the risks at this level of authority. This is Apple's security judgment on the permission model, not an investigation conclusion on a certain attack, a certain application or a confirmed data leak; the announcement did not give the number of affected users or the scale of the incident.
Future controls still lack implementation details
In response to the above issues, Apple has disclosed only two principles: authorization must come from a very clear user operation, and users should clearly understand the risks and make an informed decision before granting. The announcement did not show the new confirmation interface, nor did it explain whether it would add two-step verification, temporary authorization, permission classification or automatic revocation. The system interface, developer review, existing authorization migration and revocation process are also not disclosed. Therefore, the final product design cannot be inferred from the statement of principles, nor can the plan be written as a constraint that has taken effect.
Apple's existing Mac Help documentation explains that full disk access allows applications to read all files on the computer, including data from other applications, such as Mail, Messages, Safari and Home applications, as well as Time Machine backups and some management settings for all users of this Mac. The current user can view the related list in the privacy and security area of the system settings and manually add applications. The above document describes the current scope of authority and operation entrance, not the instructions for the use of the new controls mentioned in the announcement on October 2.
What context does the current permissions model provide?
The current security document also gives the version background of the permission model: macOS 10.15 or later requires applications to obtain user consent before accessing documents, downloads, desktops, iCloud Drive, and network volumes; in macOS 10.13 or later, applications that need to access the entire storage device must be explicitly added by the user in the privacy settings. For macOS 13 or later, the path listed in the documentation is System Settings, Privacy & Security, Privacy. These version numbers cannot be used to infer the minimum version of the new control.
In a public information stream at 18:11 on October 2, TechCrunch summarized the news as Apple preparing to strengthen macOS full disk access control and list files, messages, emails, and browsing history as risk areas. Information released by The Verge at 20:08 on the same day emphasized that Apple will increase restrictions and relayed the requirements for very clear user operations. The main lines of events recorded by two front-line technology media are consistent with Apple's announcement, but they do not provide implementation specifications that can replace official technical documents.
Differences in media representations and matters to be confirmed
There are boundaries between media representations and official tenses that need to be preserved. Part of the summary uses the tone that it is being rolled out or will restrict access. Apple's original text says that additional controls will be introduced in the future, without giving a release time. Based on this, this article writes it as a plan that has been announced but not yet launched, rather than that the current macOS has changed the authorization process. Apple has not stated that it will completely prohibit AI applications from applying for permissions; the announcement discusses the high-privilege entrance of full disk access, and user authorization must be clearer.
As of this round of verification, the public materials still lack the release date of the new control, applicable system versions, interfaces and interfaces, developer migration requirements, enterprise device management rules, and how to deal with existing authorizations. Apple did not name the apps that may have been used improperly, disclosed the number of attacks, the scale of the data exposure, external audits or quantitative risk comparisons. Whether the new mechanism will change the way backup software and communication tools work, and whether it will increase enterprise management costs, cannot be confirmed from the existing announcements; subsequent judgment must wait for official documents.