- Apple: agent access needs controls
+ Wallet Pass Designer beta
+ Utah VPN-location rules blockedClicking Allow feels like the end of a permission decision. Apple says increasingly autonomous AI agents make Full Disk Access a substantially growing risk, and it plans additional controls. One useful backup permission can expose a much wider input surface when an assistant starts interpreting what it reads.
The access boundary
Apple's documentation includes data from Mail, Messages and Safari, plus Time Machine backups. Full Disk Access is already user-granted through System Settings. Apple's October 2 notice promises additional controls around that grant, requiring “very explicit user action.” It gives no rollout date, new interface or named target.
On X, javi's response was “I hope you like permission prompts.” Automation keeps asking us to manually approve the automation. There is a real product tradeoff here: terminals, search tools and backup utilities can have legitimate reasons for broad access. Removing it carelessly would create a very secure broken workflow.
Keep the capabilities separate. Apple's guide lists Accessibility and Automation independently from Full Disk Access. Reading protected data and controlling another app involve different controls.
A disputed example, and a measured one
Jason Aten said Meta's Muse read his messages without permission. Meta disputes that account. Andy Stone says both Full Disk Access and the Messages connector are required. Apple's notice names neither Muse nor any other application; it supplies no resolution to this dispute.
There is an independently measured agent problem underneath the argument. An email or webpage can carry instructions that try to redirect an assistant while it does useful work. AgentDojo tests this prompt-injection boundary across 97 tasks and 629 security cases.
In one historical GPT-4o configuration from June 2024, targeted attack success was 47.69%. Filtering available tools brought it to 6.84%. Those figures describe one model and one attack setup. They illustrate why tool boundaries matter; Apple's future controls have not been evaluated here.
The takeaway is practical: give an assistant the data and tools its task needs. A selected project folder is a smaller input surface than a whole account. Reading a source and authorizing a send or delete operation are decisions the product can distinguish.
Also in today's diff
Pass Designer beta: Apple's new Wallet pass editor offers templates, field validation and live previews using the same rendering as iOS and watchOS. Semantic data can produce backward-compatible passes. The beta needs macOS 27 or later; Apple lists free registration for the download. Your concert ticket can finally become structured data before becoming a blurry screenshot in somebody's family group chat.
Utah's VPN-location rules: EFF reports a preliminary injunction against challenged provisions of SB 73. It quotes the court saying “geolocation perfection is not presently possible.” A website sees a VPN server's exit address, which cannot guarantee where a person is sitting. The network stack still refuses to implement features merely because a legislature opened a ticket.
The court's reasoning, as quoted by EFF, describes a burden reaching 28 million Aylo users. The injunction is preliminary, and the separate VPN-information restriction was not challenged.
The person who never clicked Allow
Apple expressly warns about the privacy of people communicating with the user. Your conversation contains the other person's information too. They never clicked the Allow button on your Mac. That wider circle is why I care about the implementation: the permission flow needs to explain what the assistant will receive.
Verdict: NEEDS REVIEW. I want clearer consent and narrower access, with legitimate workflows preserved. Apple's implementation will decide whether it delivers.
Sources
https://developer.apple.com/news/?id=p6zjojqw
https://news.ycombinator.com/item?id=49937631
https://support.apple.com/guide/mac-help/change-privacy-security-settings-on-mac-mchl211c911f/mac
https://techcrunch.com/2026/10/02/apple-says-its-tightening-macos-full-disk-access-controls-due-to-new-risks-from-ai-agents/
https://techcrunch.com/2026/09/30/meta-disputes-claim-that-muse-read-a-users-private-messages-without-permission/
https://x.com/andymstone/status/2105106775259128080
https://x.com/Javi/status/2106118858855616683
https://arxiv.org/abs/2406.13352
https://agentdojo.spylab.ai/results/
https://developer.apple.com/pass-designer/
https://www.eff.org/deeplinks/2026/10/court-agrees-eff-utahs-vpn-law-demands-technical-impossibility
And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.