Apple Tightens Mac File Access Over AI Agents (10/02/2026)

Full Disk Access was designed for backup tools and security software, programs that genuinely need to read everything on a Mac and that a user installs on purpose. Apple now says AI agents are asking for the same access, and that “the risks associated with this level of access will grow substantially” as those agents become more capable. Coming two days after Meta disputed a columnist’s account of what its Mac agent read, that is a platform owner admitting the permission model was not built for software that decides for itself what to look at.

Top 5 Critical Privacy Alerts

1. Apple Tightens macOS Full Disk Access Because of AI Agents

Apple said it will add controls so that users grant Full Disk Access only through “very explicit user action,” warning that some developers use the permission “in ways that could put users at risk, exposing everything on their systems,” per TechCrunch. The announcement followed the dispute over Meta’s Muse agent we covered on September 30 and a report about a flaw in ChatGPT’s Mac app. Apple has not said which macOS release will carry the change.

Operator Note: Do not wait for the operating system. On managed Macs, list every application holding Full Disk Access today and remove it from anything that is not backup or security software you deployed.

2. A Dozen Flock Cameras in Florida Have No Known Owner

St. Lucie County, Florida, found about a dozen Flock surveillance cameras that had not been approved by the county and whose owner it could not identify, per Schneier on Security. Schneier suspects a local agency that skipped the approval process, and warns that “once we normalize a surveillance infrastructure, both friends and foes will take advantage of it.”

Operator Note: If your organization shares camera feeds or plate data with a local agency, ask for a list of the devices and who controls each one. If the agency cannot produce it, nobody can.

3. A New Site-Blocking Bill Would Reach VPN Providers

Rep. Darrell Issa introduced the American Copyright Protection Act, H.R. 10364, which would let copyright owners obtain court orders requiring internet providers, DNS services, and VPN providers to take “commercially reasonable steps” to block Americans from designated foreign piracy sites, per the EFF. The EFF says the bill drops last year’s protections for VPN-only and encrypted DNS providers, and that the accused site does not necessarily get to defend itself before it is designated.

4. Court Lets Unions Challenge Social Media Monitoring of Visa Holders

Judge Alvin Hellerstein in the Southern District of New York rejected the government’s motion to dismiss United Auto Workers v. Department of State, a challenge by three unions to a program using AI to monitor the social media of visa and green card holders, finding the program plausibly violates the First Amendment, per the EFF.

5. The Kids Online Safety Act Stalls in the Senate

Sen. Rand Paul blocked the Kids Online Safety Act from passing by unanimous consent before the Senate’s recess, and the Senate bill’s duty of care still conflicts with the House version, per Biometric Update. Neither bill mandates age verification, but both turn on whether a platform knows a user is a minor, which pushes platforms toward age checks anyway.

Additional Privacy Alerts

Biometrics & Physical Access

• A third of security professionals say their access controllers lack cybersecurity features: In a survey of 561 professionals by HID’s Mercury Security, 32% said so, up from 21% previously. Biometric Update

Regulatory Updates

• California’s new AI employment laws: Covington summarizes what the new laws require of employers in the state. Inside Privacy

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.