Overview
Apple is addressing a significant security risk on macOS related to the Full Disk Access (FDA) permission. Certain AI agents are leveraging FDA in ways that grant them overly broad access to user data, including personal files, emails, messages, and browsing history, often without the user’s full understanding. This initiative aims to close a potential privacy and security gap that could lead to widespread data exposure.
Technical Analysis
- Vulnerability: Misuse of the macOS Full Disk Access (FDA) permission by applications, specifically AI agents.
- Mechanism: FDA is a legitimate macOS security feature designed to allow applications (e.g., backup software, antivirus) to access protected user data directories.
- Exploitation: Developers of some AI agents are requesting and receiving FDA, which then grants their applications unrestricted access to sensitive user data across the system. This access includes
/Users/<username>/Library/Mail,/Users/<username>/Library/Messages, Safari history, and other personal files. - Prerequisites: The user must grant FDA to the AI agent application. The core issue is that the scope of this permission is often not fully understood by the user, and the application may not explicitly inform the user about the full extent of data it will access.
- Impact: Unauthorized access to sensitive user data, potential for data exfiltration, privacy violations, and compromise of system integrity if the AI agent is malicious or compromised.
Detection
- Monitor macOS unified logs for
TCC(Transparency, Consent, and Control) database changes related to FDA grants, if available via EDR or audit logs. - Review
tccutiloutput orTCC.dbfor applications withkTCCServiceSystemPolicyAllFilespermission. - Behavioral analysis of applications granted FDA: look for unusual file access patterns, excessive reads from sensitive directories (e.g., mail, messages, browser history), or network connections to untrusted destinations.
- Endpoint Detection and Response (EDR) solutions can track process activity and file access by applications with FDA.
Sigma Detection Rules
⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.
macOS Application Accessing Sensitive User Data Directories
title: macOS Application Accessing Sensitive User Data Directories
id: 5a8b3c2d-e1f2-4a3b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects applications accessing sensitive user data directories on macOS, potentially indicating misuse of Full Disk Access by AI agents or other applications.
logsource:
product: macos
service: file_access
detection:
selection_mail:
TargetFilename|contains: '/Library/Mail/'
selection_messages:
TargetFilename|contains: '/Library/Messages/'
selection_safari_history:
TargetFilename|contains: '/Library/Safari/History.db'
condition: 1 of selection_*
level: high
Mitigations
- Review FDA Grants: Regularly audit applications listed under System Settings > Privacy & Security > Full Disk Access. Revoke FDA for any application not explicitly requiring it or for those whose purpose does not justify such broad access.
- Exercise Caution with AI Agents: Be highly selective when installing and granting permissions to AI agent applications, especially those requesting FDA. Understand the data access implications before approval.
- Monitor for Apple Updates: Apply macOS security updates promptly as Apple implements tighter controls around FDA and AI agent data access.
- Least Privilege: Adhere to the principle of least privilege for all applications. Only grant necessary permissions.
- Data Minimization: Limit the amount of sensitive data stored locally where possible, especially if using applications that require broad system access.
References
- https://thehackernews.com/2026/10/apple-plans-tighter-macos-full-disk.html
Indicators of Compromise
No public IOCs available at time of writing.
MITRE ATT&CK
T1083— File and Directory Discovery
🤖 AI Attribution
Generated by
1,533 input / 1,069 output tokens ·
Reviewed and approved by a human analyst before publication
Generated by
gemini-2.5-flash ·1,533 input / 1,069 output tokens ·
Reviewed and approved by a human analyst before publication