macOS Full Disk Access and AI Agents: What Apple Said

What did Apple say about Full Disk Access, and what does it mean for AI agents? On October 2, 2026, Apple posted a short developer news item, “Updates to Full Disk Access in macOS.” It says Full Disk Access “largely sidesteps” the controls that protect users’ private data, that “Some developers are using Full Disk Access in ways that could put users at risk,” and that “Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action.” The reason it gives: “As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.”¹ It names no macOS version, no date, no mechanism and no app. For anyone running agents on a Mac, the part that matters today is how an agent ends up with this access. A command-line agent runs under the terminal that launched it. In the Apple documentation I read, there is no general rule for that, but Apple’s eslogger man page says that running that tool “from an app, including Terminal.app or a third-party terminal emulator, requires the respective app to be authorized for Full Disk Access.”² An Apple support engineer, in a forum post, puts it as “The tool’s responsible code is Terminal.”³ Give your terminal Full Disk Access and every agent you start in it can read what the terminal can read: Mail, Messages, Safari data and Time Machine backups, in Apple’s list.⁴ The vendors’ sandboxes do not change that by default. On my Mac, a read that needs Full Disk Access succeeded from the agent’s shell, succeeded again inside Codex’s read-only sandbox and inside Anthropic’s sandbox runtime, and was refused only when a sandbox rule denied that exact folder or when I launched the same read outside the terminal.⁵

TL;DR

• What Apple said. On October 2, 2026, Apple told developers it “will introduce additional controls” so that granting Full Disk Access takes “very explicit user action,” and named AI agents as the reason the risk “will grow substantially.” The item gives no version, date or mechanism. The macOS 27.2 beta 3 release notes carry no line about it. I found no macOS 27.1 entry in the October 11 releases feed or release-notes index: the feed lists macOS 27.0.1 (September 28), which shipped with no developer release notes, and then macOS 27.2 beta 3; the 27.2 betas themselves began September 16.¹⁶⁷⁸⁹
• What Full Disk Access is. A Privacy & Security setting that lets an app “access all files on your computer,” including data from Mail, Messages, Safari and Home, Time Machine backups, and “certain administrative settings for all users on this Mac.” An app cannot prompt for it; the user adds the app by hand, or an MDM profile grants it. In what I read, Apple has tied it to backup and disk tools three times: at WWDC19, at WWDC23, and on October 2.^410211121
• How agents get it. Two paths. A command-line agent (Claude Code, Codex CLI, Gemini CLI, Hermes Agent, Aider) is checked against the app it runs inside, so a terminal with Full Disk Access passes it on; Apple states this per tool in man pages and through its support engineers on its forums, never as a documented general rule. Desktop agent apps hold their own entries, and two agent vendors, Nous Research for Hermes and OpenClaw, tell users to grant Full Disk Access so the agent can read Messages.²³¹³¹⁴
• What the sandboxes do. Seatbelt sandboxes in Claude Code, Codex, Gemini CLI and Cursor confine writes, and all but Gemini CLI’s default profile confine the network; their default reads are broad. On my Mac the two sandboxes I ran left the Full Disk Access grant in place, and by Apple’s support engineer’s description of mandatory access control, none can add one. Claude Code’s sandbox is off by default; Codex’s is on. On my Mac a protected read went through Codex’s read-only sandbox and through Anthropic’s sandbox runtime; inside the sandboxes it stopped only when I denied the folder by name.^151617185
• On my Mac. The Full Disk Access list holds 75 rows: three terminals, the ChatGPT, Cursor and Xcode apps, 30 version-numbered Claude Code binaries, node and four Python interpreters, and the SSH server’s entry, among others. The agent’s shell inside Ghostty had working access; the same read from a launchd job, with no terminal above it, was refused by TCC.¹⁹⁵
• What to do now. See who holds it; take it off the terminal you run agents in; never give it to an interpreter; turn the vendor sandbox on and deny reads you do not need; run any agent that reads Messages under a separate macOS user, or not at all; and keep per-send approval for anything that speaks as you. Each step below has its source and its cost.^420152122
• What could change. Apple’s words allow a harder grant flow, a narrower scope, a different treatment of grants that pass from one app to the programs it launches, and changes for managed Macs. Section 7 reads each against Apple’s own adjacent changes in macOS 27 and Xcode 27, with the condition each depends on. None is a forecast.^1232425

1. What Apple said on October 2, and what it did not say

Apple’s developer news feed dated the item Friday, October 2, 2026, 09:00:19 Pacific, between a notice about an expiring Developer ID certificate authority on October 1 and the iPhone Duo and App Store asset announcements of October 5.²⁶ The item is two paragraphs. I saved it on October 11 and fetched it again 19 minutes later; apart from curly versus straight apostrophes, the two copies are identical, so it did not change between my two reads.¹

The first paragraph sets up the problem. Apple says it gives developers “powerful APIs to build incredible capabilities into their apps for Apple products, backed by a set of controls designed to protect users’ private data,” and then: “Full Disk Access largely sidesteps these controls in order to allow backup apps to function properly on the Mac.” The next sentence is the charge: “Some developers are using Full Disk Access in ways that could put users at risk,” exposing “everything on their systems,” which Apple spells out as “files, mail, messages, and even browsing history,” and doing it “without users’ full knowledge and understanding.” The paragraph closes on people who never agreed to anything: “For communication apps, this can also compromise the privacy of the people users are communicating with.”¹

The second paragraph is the promise and the reason, quoted whole:

“Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action. Addressing this is critical. As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially. We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.”¹

Three things in it are worth reading slowly.

The subject is the grant, not the API. Every verb in the promise is about the moment a user grants access: users “who genuinely wish to grant an app,” “very explicit user action,” understanding the risks “before granting such access.” Nothing in the item says Full Disk Access will cover less, or that apps holding it will be reviewed, or that it will go away. My reading, labeled as one: the item describes a change to how the switch is turned on, and says nothing either way about what the switch unlocks once it is on.

The reason is agents, but the target is apps. Apple names “AI agents” once, as the reason the risk “will grow substantially.” It does not say agents are the apps misusing the access today; that sentence is about “Some developers.” It also does not say how a control on granting “an app” would reach an agent, which on a Mac is often not an app at all but a command-line program running inside one. Section 3 is about exactly that gap.

“Communication apps” is the category it singles out for harm to others. Apple names no app and no developer. The item names two kinds of software: backup apps, as the reason the access exists, and communication apps, the one it ties to a harm beyond the user: the people on the other side of a conversation, who granted nothing. Section 3 shows two agent vendors whose Messages integrations are documented to need Full Disk Access; whether Apple had any of them in mind, the item does not say, and I do not assume it.

What the item does not say

Read for what is absent, the item has:

• No macOS version and no date. “Going forward” is the only time word.
• No mechanism. No prompt design, entitlement, API, App Review rule, or device-management change.
• No word on existing grants. It does not say whether apps already in the Full Disk Access list keep their place, or whether users will be asked again.
• No word on managed Macs. It does not mention MDM, though MDM can grant Full Disk Access today (section 2).
• No developer action. No deadline, no documentation link, no date by which apps must change.

I looked in the places Apple would put a mechanism. The macOS release-notes index, read on October 11, lists exactly two macOS 27 entries, “macOS 27.2 Golden Gate Beta 3 Release Notes” and “macOS 27 Golden Gate Release Notes.” I found no macOS 27.1 entry in that index or in Apple’s releases feed, read the same day, which lists macOS 27.0.1 (26A434), dated September 28, and then the 27.2 beta 3. The 27.0.1 update has no developer release-notes page; the address such a page would use returned HTTP 404 when I tried it, as did the 27.1 and 27.1 beta addresses.⁸⁷ The 27.2 beta 3 notes (the beta, build 26B5101f, is dated October 5 in Apple’s releases feed, three days after the item) have six sections (General, AppKit, Display Settings, Notifications, Shortcuts, StoreKit Testing in Xcode), and none mentions Full Disk Access, TCC or Privacy & Security; the nearest thing is an AppKit line saying a pasteboard-privacy developer-preview default “has been removed.”⁶⁷ Apple’s October developer newsletter, published four days after the item, covers iPhone Duo submissions, labs and documentation, and says nothing about Full Disk Access or agents.²⁷ The four WWDC26 sessions Apple files under Privacy & Security, including one titled “Secure your app: mitigate risks to agentic features,” do not mention Full Disk Access.²⁸²⁹

The only other Apple text about agents and file access

One Apple document does talk about file permissions for AI agents, and it is about Xcode, not macOS. The Xcode 27 release notes say: “Coding Intelligence now includes a new security layer that monitors and controls filesystem access by coding agents and any processes they spawn. This can be enabled in Coding Intelligence settings.”²⁴ That is the whole entry. It does not say what the layer allows or blocks, whether it is on by default (the wording “can be enabled” suggests it is not), how it relates to TCC, or whether it covers agents outside Xcode. The same notes describe a preview MCP server that lets “code-signed agents” use projects in a directory tree “for extended periods of time without being asked for additional permissions,” and a flag, --unsafe-always-allow-all-agents, that Apple says “is not a recommended configuration for at-desk use.”²⁴ Neither entry mentions Full Disk Access.

The WWDC26 agentic-features session is the closest thing to a threat model for agents in the Apple material I read. It cites “Simon Willison’s Lethal Trifecta,” in which a user is in most danger when an agent has “access to private data, exposure to untrusted content, and the ability to externally communicate.”²⁹ Full Disk Access is the first of those three in one switch, which is my reading of why the October item says the risk grows with agents, not Apple’s stated reasoning.

2. What Full Disk Access is

The control, in Apple’s words

Full Disk Access is one row in System Settings > Privacy & Security. Apple’s Mac User Guide for macOS 27 describes it this way: “Allow apps to access all files on your computer, including data from other apps (for example, Mail, Messages, Safari, and Home), data from Time Machine backups, and certain administrative settings for all users on this Mac.”⁴ The rows around it read differently. Calendars, Contacts, Files & Folders and most others end with “The listed apps have requested access.” The Full Disk Access row instead says “To add an app, click [the Add button] , select the app in the list, then click Open.”⁴ The difference is the point: apps ask for the others, and the user goes looking for this one.

Apple Platform Security says the same thing as a table. Its page on controlling app access to files lists “Full internal storage access” (its name for the same control) with a cross under “User prompted by app” and a check under “User needs to edit system privacy settings”; Files and folders, by contrast, is prompted by the app.¹⁰ The device-management reference, written for administrators, describes the service as access “to all protected files, including system administration files,” and Apple’s deployment guide lists it as “System Policy All Files,” which “Allows specified apps access to data like Mail, Messages, Safari, Home, Time Machine backups, and certain administrative settings for all users of the Mac.”³⁰³¹

Three things Apple does not publish are worth knowing before you reason about it:

• There is no complete list of what it protects. An Apple Developer Technical Support engineer, writing on Apple’s developer forums (a staff post, not documentation), says “The exact list of file system locations protected by MAC is not documented and, as illustrated by the list above, can change over time.”²⁰ MAC here is mandatory access control, the mechanism underneath.
• It is not per user. The same engineer: “Some MAC privileges are per user (Files and Folders) and some are system wide (Full Disk Access).”²⁰ A grant made while signed in to one account holds for that program in every account.
• TCC is a name Apple uses but barely defines. The subsystem that keeps these decisions is TCC. The macOS 27 SDK’s Endpoint Security header spells it “Transparency, Consent, and Control (TCC),” an Apple panel at WWDC26 said “TCC stands for transparency, consent and control,” and the support engineer’s post adds that TCC “has no API surface.”³²³³²⁰ In TCC’s own database on my Mac, the Full Disk Access rows are stored under the service name kTCCServiceSystemPolicyAllFiles. That string appears in no Apple document, man page or SDK header I checked; Apple’s documented names are the profile key SystemPolicyAllFiles and the settings anchor Privacy_AllFiles.^19302534

How it is granted

By the user, by hand. The user opens the Full Disk Access row, clicks Add, and picks the app.⁴ Apple documents no way for an app to raise a prompt for it. What Apple’s documentation offers instead is a link that takes the user to the right pane. For apps entitled as Endpoint Security clients (the header requires the com.apple.developer.endpoint-security.client entitlement of es_new_client callers), the Endpoint Security header says “The only supported way to check if an application is properly TCC authorized for Full Disk Access is to call es_new_client and handling ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED,” and that “To direct the user to the Full Disk Access section in System Settings,” an app can open x-apple.systempreferences:com.apple.settings.PrivacySecurity.extension?Privacy_AllFiles on macOS 13 and later.²⁵ At WWDC19 Apple described the same pattern: apps “can test for authorization using FileManager or POSIX level APIs, and if necessary, can guide the user to the security and privacy preference pane, where the user can then approve the app if that’s what they want.”¹¹ In 2018 a developer on Apple’s forums asked for “an API call that causes a prompt to the logged-in user to grant the app Full Disk access because there’s no way to trigger a prompt like that right now, and that’s what backup apps need”; Apple’s support engineer replied, “Please do file an enhancement request.”³⁵ In everything I read for this post, Apple’s documentation still describes only the link, eight years later.

One convenience exists. Since Catalina, a program that is refused for lack of Full Disk Access shows up in the list already, switched off: “executables that are denied access to files due to a lack of Full Disk Access approval are now prepopulated unchecked.”¹¹ The user still has to turn it on.

By an MDM profile. On a managed Mac, the Privacy Preferences Policy Control payload (type com.apple.TCC.configuration-profile-policy, macOS only, since 10.14) can grant it. The eslogger man page states it plainly: “MDM servers can grant Full Disk Access authorization using the Privacy Preferences Policy Control payload, identified by payload type com.apple.TCC.configuration-profile-policy, and its service dictionary key SystemPolicyAllFiles.”²³⁶ When the per-app entry’s Allowed key is true, Apple’s reference says “access is granted,” and adds: “The user isn’t prompted and can’t change this value.”³⁷ Apple’s deployment guide’s own sample comment for this payload reads “Allows my organization’s app to interact with all files without prompting the user.”³¹ This is a real asymmetry: for the camera, the microphone, screen capture and keyboard listening, Apple’s reference says a profile “can’t grant” access and “can only deny it.” It says no such thing for SystemPolicyAllFiles.³⁰

Two Apple pages disagree about this payload, and one changed this year:

• Supervision. The deployment guide says “Supervision is required if you apply this payload using a device management service.” The developer reference’s availability table lists “Requires supervision” as N/A.³¹³⁶ I report both and pick neither.
• macOS 27 deprecated the per-app part. In the current reference, the Identity object every service entry uses, Full Disk Access included, is marked deprecated at macOS 27.0, and each of its keys reads “Deprecated: macOS 27+.” The SystemPolicyAllFiles entry itself carries no deprecation marker.³⁷³⁰ The declarative replacement Apple points other services to, the app settings configuration, offers privacy defaults for accessibility, Bluetooth, camera, dictation, local network, location and microphone. It has no Full Disk Access key, and its defaults are consent-gated: “When set, the app displays a consent prompt listing all the configured defaults.”³⁸³⁹ Apple does not connect this to the October 2 item, and neither do I; it is a fact next to the story.

Why it exists: backup apps, three times

In each of the three places I found Apple saying whom Full Disk Access is for, it named the same kind of software. At WWDC19, describing the two tiers of protected data, Apple put “things like mail or messages and Safari browsing history” in the second tier and said these “have a high barrier to access because the files are typically only accessed by specialized apps such as disk management or backup utilities.”¹¹ At WWDC23, introducing app container protection, Apple said “For backup utilities or disk-management tools that have already been granted Full Disk Access, no additional prompt will be shown at time of access, since people have already chosen to allow these apps access to all files.”¹² On October 2 it said Full Disk Access sidesteps the data controls “in order to allow backup apps to function properly on the Mac.”¹ An agent is not a backup app. That is the whole tension in one sentence.

Where it came from

Most of Apple’s sources date Full Disk Access to macOS Mojave in 2018. Apple’s June 4, 2018 press release said “New data protections require apps to get user permission before using the Mac camera and microphone or accessing personal data like user Mail history and Messages database.”⁴⁰ The Mojave 10.14 release notes, still online, use the name Application Data, which a developer on Apple’s forums in August 2018 called the name in earlier betas:³⁵ “Apps can’t access protected storage unless they’re added to the Application Data category located in the Privacy tab of System Preferences > Security & Privacy.”⁴¹ The device-management payload and its SystemPolicyAllFiles key are marked as introduced in macOS 10.14, and Apple’s support engineer’s post lists “Full Disk Access (macOS 10.14 and later).”³⁶²⁰

One Apple page dates it differently. Apple Platform Security says “In macOS 10.13 or later, apps that require access to the full storage device need to be explicitly added in System Settings (macOS 13 or later) or System Preferences (macOS 12 or earlier).”¹⁰ Every other Apple source I read says 10.14. I report the disagreement and pick neither.

Catalina (10.15, released October 7, 2019) widened the protected set. Its press release said “new data protections require all apps to get permission before accessing user documents,” and at WWDC19 Apple added the Desktop, Documents and Downloads folders, iCloud Drive, third-party cloud storage, removable volumes and network volumes to the consent-gated list, and said “the universe of data that requires preapproval for Full Disk Access has been expanded to include trash.”⁴²¹¹ Later releases added app container protection (macOS 14) and app group container protection (macOS 15), both about apps reading other apps’ data; for the first, Apple said Full Disk Access holders would see no additional prompt.²⁰¹²

macOS 27 moved again in the same direction. Its release notes say access to “other developer teams’ app data containers and app group containers no longer prompts the user for authorization; such accesses are denied by default and can be managed by the user in Privacy & Security settings,” that “XProtect may now restrict access to app data that is commonly targeted by malicious software,” and, under TCC, “Apps can no longer access the local TCC database directly.”²³ In one known issue, Apple’s own notes recommend Full Disk Access as a stopgap: when a process without a bundle ID cannot be given access to another team’s container, “Workaround: Consider if the access is necessary. If required, grant Full Disk Access to the process for the duration of the requirement.”²³ The macOS 27 release notes post and the cross-team container post cover those changes in full.

3. How an agent gets it

There are two ways an AI agent on a Mac ends up able to read what Full Disk Access protects. It runs inside an app that holds the grant, or it is an app that holds the grant. The first is how most command-line agents get it, and nobody has to click anything for the agent itself.

The terminal path

When you type claude or codex in a terminal, macOS does not ask whether Claude Code or Codex may read your Messages. It asks whether the terminal may. Apple calls the program it checks the “responsible” one, and in no Apple documentation I found is the rule for choosing it stated as a general one. What it has published is a set of specific statements that all point the same way:

• eslogger(1), shipped with macOS 27: “eslogger requires the responsible process to have been authorized for Full Disk Access,” and “Running eslogger from an app, including Terminal.app or a third-party terminal emulator, requires the respective app to be authorized for Full Disk Access in System Preferences > Security & Privacy > Privacy > Full Disk Access.”²
• tmutil(8): “Full Disk Access privileges can be granted to the Terminal application used to run tmutil from the Privacy tab in the Security & Privacy preference pane.”⁴³
• fdesetup(8): since macOS 10.15, enabling FileVault from the command line needs, among other options, that “The responsible application is authorized for” Full Disk Access.⁴⁴
• Apple’s device-management reference: “Helper tools embedded within an application bundle automatically inherit the permissions of their enclosing app bundle.”³⁷

The most direct statement comes from Quinn, an engineer in Apple Developer Technical Support, answering a forum thread in June 2024 about command-line tools and Full Disk Access. It is a staff post on Apple’s site, not documentation, and I label it that way every time I use it. He lists four cases. For a tool run by the user from Terminal, “The tool’s responsible code is Terminal.” For a tool run over SSH, “The tool’s responsible code is the SSH server.” For a helper launched by an app, “The system treats the app as the responsible code.” For a launchd job, installing it through SMAppService makes the app the responsible code; otherwise, he writes, the job’s property list should name the app with AssociatedBundleIdentifiers.³ In the same thread he adds the caveat that matters for anyone planning around this: “The exact algorithm it uses for this is not documented, has changed in the past, and may well change in the future.”³ Asked in a different thread whether TCC “is looking for parent process rights,” he declined to go into it because it is “both complex and subject to change.”⁴⁵

The developer who started the June 2024 thread had already measured the effect: “When this program is built and executed in Terminal.app with Terminal having FDA, the file opens successfully. Conversely, when FDA is revoked from Terminal and granted to the program, an error occurs due to insufficient privileges.”³ That is a developer’s report, not Apple’s. Its first half matches what I measured on my own Mac (section 5): the read worked with the grant in the terminal’s launch chain. I did not test its second half; my control changed where the read was launched, not which app held the grant.

Two consequences follow, and neither is specific to agents.

Everything you start in that terminal gets it. The agent, the shell it spawns, git, npm install, a test runner, an MCP server launched over stdio, a script the model wrote a minute ago: if they run under the terminal, the terminal is what TCC checks. Apple’s support engineer makes the point about interpreters directly: “if you have a script that needs to manipulate files on your desktop, you wouldn’t want to give the interpreter that privilege because then any script could do that.”²⁰ A terminal with Full Disk Access is the same problem one level up.

Other apps can borrow it. In 2022 Jeff Johnson published “Every unsandboxed app has Full Disk Access if Terminal does,” with source code. His point: “unsandboxed apps can open executable shell scripts in Terminal, and those scripts will execute with the permissions not of the opening app but rather with the permissions of Terminal, i.e. Full Disk Access.” The technique, he notes, “doesn’t work for sandboxed apps.”⁴⁶ Every agent desktop app I inspected on my Mac is unsandboxed: the Claude app and Cursor carry no App Sandbox entitlement, and the ChatGPT app carries it set to false.⁴⁷ My reading, not Johnson’s claim: on a Mac where the terminal holds Full Disk Access, any of those apps could reach it the same way.

What do the terminals themselves say? I found no Ghostty or iTerm2 documentation that states what child processes get when the terminal holds Full Disk Access: GitHub code searches of Ghostty’s docs and iTerm2’s repository for the phrase returned nothing. I did not search Apple’s Terminal or Warp documentation the same way.⁴⁸ What the apps do show is whom they speak for. Their purpose strings, read from the installed apps on my Mac, are written on behalf of whatever runs inside them: Ghostty’s AppleScript prompt reads “A program running within Ghostty would like to use AppleScript,” and iTerm2’s reads “An application in iTerm2 wants to use AppleScript.”⁴⁷ macOS has no purpose string for Full Disk Access, since apps cannot prompt for it, but the strings show the design: the terminal is the app the user is asked about.

The editors with built-in agents work the same way one level over. Cursor’s documentation says “Cursor runs shell commands directly in your terminal,” which I read, in the editor, as Cursor’s own integrated terminal.⁴⁹ By the support engineer’s helper case above (a tool spawned by an app is charged to the app), Cursor is then the app TCC sees for those commands. That is my inference; Cursor’s documentation does not say which app TCC charges.³¹⁸

The SSH path

If you drive an agent over SSH, the terminal on the far end is not the responsible code; the SSH server is. Apple’s support engineer: “The tool’s responsible code is the SSH server. You can set Full Disk Access on that using System Settings > General > Sharing > Remote Login > Allow full disk access for remote users.”³ The eslogger man page names the same setting.² OpenClaw’s setup guide shows the SSH-side client as it appears in TCC, /usr/libexec/sshd-keygen-wrapper, and that exact client is listed for Full Disk Access on my Mac.¹⁴¹⁹

What the agent vendors tell you to do

Two agent projects tell users, in their own documentation, to grant Full Disk Access so the agent can read Messages:

• Hermes Agent (Nous Research). The Apple iMessage skill is listed as “Bundled (installed by default),” and its prerequisites read “Grant Full Disk Access for terminal (System Settings → Privacy → Full Disk Access)” and “Grant Automation permission for Messages.app when prompted.”¹³ That is a vendor instruction to give the terminal, and so everything run in it, Full Disk Access. The Hermes guide covers the rest of the agent.
• OpenClaw. Its iMessage setup says “Full Disk Access is required for the process context running OpenClaw/imsg” (for the Messages database), “Automation permission is required to send messages through Messages.app,” and “Permissions are granted per process context.”¹⁴ The same page says that for advanced actions such as reactions, edits and unsend, “System Integrity Protection must be disabled,” while basic send and receive work without it.¹⁴ OpenClaw’s macOS permissions page gives the same rule for the Desktop, Documents and Downloads folders: “grant access to the same process context that performs file operations (for example Terminal/iTerm, LaunchAgent-launched app, or SSH process).”⁵⁰

Anthropic documents a narrower case. Claude Code’s background sessions, per its agent view documentation, run a host process that “requests access to protected folders separately from your terminal,” and if a background session reports “Operation not permitted” on a protected location, the fix is to “grant access in System Settings under Privacy & Security > Files and Folders, or enable Full Disk Access for the entry.” With the native installer, it says, “the entry appears as Claude Code and the grant persists across updates.”⁵¹ For computer use, Anthropic tells users to check that “your terminal app is listed and enabled” under Screen Recording, which is the terminal path again, for a different permission.⁵² None of Anthropic’s sandboxing, permissions or security pages mentions Full Disk Access.¹⁵⁵³

The desktop-app path

Desktop agent apps get their own rows in Privacy & Security, and what they ask for varies:

• ChatGPT for Mac (on my Mac, its bundle ID is com.openai.codex). On August 20, 2026, OpenAI added an Apple Messages plugin: “On Apple silicon Macs, the Apple Messages plugin in the ChatGPT desktop app can read and search iMessage, SMS, and RCS conversations and prepare or send messages through Messages.”⁵⁴ OpenAI’s plugin guide says only “Grant the requested macOS permissions before ChatGPT reads Messages.”²² I found no OpenAI page that names the permission. MacRumors, reporting the launch, wrote that “For the Messages integration to work, ChatGPT needs Full Disk Access in System Settings, as well as access to contact names and automation tools”; that is press, used here as a lead, not as OpenAI’s statement.⁵⁵ On my Mac, the ChatGPT app is listed in the Full Disk Access table.¹⁹ OpenAI’s guide also carries the warning I would put first: “Persistent approval removes your final chance to review a message before ChatGPT sends it as you.”²² For Computer Use, OpenAI asks for Screen Recording and Accessibility and says “File reads, file edits, and shell commands still follow the sandbox and approval settings for the task.”⁵⁶
• Claude for Mac. I found no Anthropic page asking for Full Disk Access. The app’s Info.plist on my Mac declares purpose strings for the Desktop, Documents and Downloads folders and for Apple Events, among others (“Claude needs this so commands you run in Claude can control other apps”).⁴⁷ Its quick entry feature asks for Screen Recording and Accessibility.⁵⁷
• Cursor. Neither of the two Cursor pages I saved, Run Modes and Terminal, asks for Full Disk Access; Cursor is listed in the table on my Mac.¹⁹¹⁸⁴⁹
• Hermes Agent computer use. Accessibility and Screen Recording go to the identity that hermes computer-use doctor names, a separate driver app, not to the terminal.⁵⁸
• VS Code with agents. Not installed on my Mac; I found no Microsoft page on Full Disk Access for its agents.⁴⁷⁵⁹

Agents by path

Sources for each cell are in sections 3 and 4.^{51166022561361146217481859} The second column’s entries for the two editors are my inference from the support engineer’s helper case, not the vendors’ statements. The third column holds the pattern. The two vendors that name Full Disk Access do so to reach Messages, the data whose exposure Apple says also reaches “the people users are communicating with”; Apple names no agent, and I do not claim it meant these two. Every other command-line agent reaches the same data, when it does, without its documentation saying that the terminal’s grant passes to it, because the grant belongs to the terminal.

4. What the vendors’ sandboxes do, and what they cannot

Two layers that do not know about each other

Every command-line agent whose macOS sandbox documentation I read builds it on Seatbelt, the system’s process sandbox, driven through sandbox-exec: Claude Code (“sandboxing uses the built-in Seatbelt framework”), Codex (“On macOS, sandboxing works out of the box using the built-in Seatbelt framework”), Gemini CLI (“Lightweight, built-in sandboxing using” sandbox-exec) and Cursor (“Cursor uses Seatbelt through” sandbox-exec).^15161718 Full Disk Access is TCC. Apple’s support engineer describes the relation: “App Sandbox and the mandatory access control system are both implemented using macOS’s sandboxing infrastructure,” but mandatory access control “is mandatory; it’s not an opt-in like the App Sandbox.”²⁰

What that means in practice has two halves. That a Seatbelt profile cannot give a process a TCC grant its responsible app lacks follows from Apple’s support engineer’s description, in which all processes, “including those running as root,” are subject to MAC; I did not test it. The other half I measured on my Mac in section 5: no sandbox changed the terminal’s grant, and a profile blocked the protected read only when it denied that path itself, on its own and while TCC would have allowed the read.²⁰⁵ A sandboxed agent inside a terminal with Full Disk Access can still read Messages if its profile allows reads there, and most default profiles allow reads almost everywhere.

One naming trap: Codex’s own source code has a function called has_full_disk_read_access, and when it returns true and no unreadable roots are configured, the generated Seatbelt profile allows file-read* everywhere; with such roots, it builds a read policy that excludes them.⁶³ That is Codex’s term for a broad Seatbelt read policy. It is not Apple’s Full Disk Access and does not grant it.

Claude Code (Anthropic)

• Sandbox: off by default. “The sandbox is off by default. To turn it on, run /sandbox in a session, as Get started shows, or set sandbox.enabled to true in a settings file.”¹⁵
• Defaults when on. Writes go to “The working directory, a per-user temp directory, and directories you’ve added.” Reads cover “Most of the machine, including credential files.” The network has “No direct route out”; connections go through a local proxy whose allowed domains “start empty.”¹⁵ The sandbox is built on “the open source @anthropic-ai/sandbox-runtime package.”¹⁵
• Two sandbox modes. Auto-allow and regular permissions; “In both, the sandbox enforces the same filesystem and network restrictions; the difference is only in whether sandboxed commands are auto-approved or require explicit permission.”¹⁵
• What is outside it. The built-in file and web tools “follow permission rules instead. A denyRead entry doesn’t stop the Read tool,” and “command hooks, local MCP servers, plugin monitors, LSP servers, and helper commands such as your status line command and apiKeyHelper run with your full access.”¹⁵ Failed commands can be retried unsandboxed unless allowUnsandboxedCommands is false.¹⁵
• Narrowing reads. sandbox.filesystem.denyRead and allowRead, or, to “deny sandboxed commands read access to home directories and mounted volumes while keeping the working directories readable, set permissions.blockReadsOutsideWorkingDirectories.”¹⁵
• Apple Events. “The sandbox blocks Apple Events by default,” and turning on allowAppleEvents “removes code-execution isolation.”¹⁵
• Permission modes, a separate control: default (labeled Manual), acceptEdits, plan, auto, dontAsk and bypassPermissions. Of the last, Anthropic says “Only use this mode in isolated environments like containers or VMs where Claude Code can’t cause damage.”⁵³

The Claude Code guide covers the settings files these keys live in.

Codex CLI (OpenAI)

• Sandbox: on by default. “The default permissions mode applies sandboxing automatically,” and “The sandbox applies to spawned commands, not just to built-in file operations.”¹⁶
• Three modes. read-only: “The agent can inspect files, but it can’t edit files or run commands without approval.” workspace-write: the agent can “read files, edit within the workspace, and run routine local commands inside that boundary. This is the default low-friction mode for local work.” danger-full-access: “The agent runs without sandbox restrictions.”¹⁶
• Network off by default. “By default, the agent runs with network access turned off,” and workspace-write “keeps network access turned off unless you enable it in your configuration.”⁶⁰
• Full access. OpenAI defines it as sandbox_mode = "danger-full-access" together with approval_policy = "never", and the desktop app’s menu describes it as unrestricted access to “the internet and any file on your computer.”¹⁶
• Reads are not spelled out in the docs. OpenAI’s one statement of scope is that the sandbox “limits what it can touch (typically to the current workspace).”⁶⁰ It does not give the read scope of read-only or workspace-write, and on my Mac run 2 (read-only) and run 2c (my configuration, no mode set) read a file far outside the workspace, one that needs Full Disk Access.⁵ The source shows why: the Seatbelt base policy starts (deny default) and notes that “child processes inherit the policy of their parent,” and with full read access and no unreadable roots the profile adds (allow file-read*).⁶³ Narrowing exists: permission profiles take "read", "write" or "deny" per path, and administrators get permissions.filesystem.deny_read in requirements.toml, “Admin-enforced filesystem read denials”; OpenAI says “users cannot weaken them with local config.”²¹

The Codex guide covers profiles and approval policies in depth.

Hermes Agent (Nous Research)

• No macOS sandbox; seven backends. “Hermes supports seven terminal backends”: local, docker, ssh, modal, daytona, vercel_sandbox and singularity.⁶¹
• Default: local, no isolation. “The default. Commands run directly on your machine with no isolation,” and “By default, local tool subprocesses keep your real OS-user HOME.”⁶¹
• Command rules are not a sandbox. “Deny rules are a shell-command policy, not a complete shell interpreter or an OS capability sandbox.”⁶⁴
• Containers are the boundary. “For production gateway deployments, use docker, modal, daytona, or vercel_sandbox backend to isolate agent commands from your host system.”⁶⁴

Under the default backend, a Hermes agent reads whatever its terminal can, and its bundled iMessage skill asks you to give that terminal Full Disk Access.¹³

OpenClaw

• Sandbox: off by default, and only for tools. “Sandboxing is off by default,” and “The Gateway process always stays on the host; only tool execution moves into the sandbox when enabled.” OpenClaw is candid about it: “This is not a perfect security boundary, but it materially limits filesystem and process access when the model does something dumb.”⁶²
• Modes. agents.defaults.sandbox.mode takes off (the default), non-main or all; the backend defaults to docker, with podman, ssh, openshell and crabbox as alternatives; Docker’s network defaults to none.⁶⁵
• Workspace access. none (the default), ro or rw.⁶⁶
• Escape hatch. tools.elevated is, in OpenClaw’s words, “an explicit escape hatch” that runs exec outside the sandbox.⁶²

The iMessage channel’s Full Disk Access belongs to the gateway’s process context, which never moves into the sandbox.¹⁴⁶²

The others, briefly

• Gemini CLI. Off unless enabled with -s, an environment variable or a setting. On macOS the default Seatbelt profile, permissive-open, “denies operations by default; confines writes to the project directory while allowing broad file reads and network access”; the profile file itself reads (allow file-read*). strict-open and strict-proxied add read restrictions.¹⁷
• Cursor. Seatbelt for “the full subprocess tree”; network “Blocked by default”; but Read Access defaults to System: “The agent can read files outside the workspace without approval. This is the default.” The Read Access setting itself needs Cursor 3.23 or later.¹⁸
• VS Code. chat.agent.sandbox.enabled, which applies to Copilot Agent Host sessions only, takes off or on and defaults to off, and Microsoft states the limit plainly: “Sandboxing is not a virtual machine or user-account boundary, and it does not replace endpoint security.”⁵⁹
• Aider. No sandbox documented.⁴⁸

The Seatbelt layer has had holes too

Researchers at Accomplish published five sandbox escapes against agent tools, in four writeups dated July 23 to September 15, 2026. Four were fixed before publication; the fifth was reported to Anthropic and closed as “Informative.” Against Claude Code, with the sandbox on and the strictest permission mode, a command from a repository “ran on our Mac anyway, outside the sandbox, with no permission prompt”; Anthropic fixed it in 2.1.247.⁶⁷ Against Cursor’s CLI, the same root cause: “the Seatbelt profile wraps only the shell tool, while the harness’s own internal git runs unsandboxed and honors repository-supplied core.fsmonitor hooks.”⁶⁸ Against Codex, two escapes reported August 12, 2026, “Both were fixed inside of eight days”; in one, “launchd starts the application unsandboxed, outside Codex’s process tree.”⁶⁹ Against Claude Cowork’s VM, an escape to a read-write mount of the host, from which it “reads and writes the host Mac’s filesystem directly, as the logged-in desktop user.”⁷⁰ None of the four writeups reads Full Disk Access data. My reading, not the researchers’ claim: a process that escapes Seatbelt but stays in the terminal’s launch chain is left with the terminal’s TCC grants, so on a Mac whose terminal holds Full Disk Access, that kind of escape reaches Full Disk Access data too. I found no postmortem, advisory or researcher writeup of an agent reading Mail, Messages or browser data through a Full Disk Access grant against the user’s intent.

5. On my Mac: what holds Full Disk Access, and how I know

Everything in this section is my own measurement on my own Mac, made on October 11, 2026, from a Claude Code session: macOS 27.0, build 26A428, System Integrity Protection enabled. Every command but two was read-only: one test submitted a launchd job, which wrote its output to two files, and then removed the job; another installed Anthropic’s sandbox-runtime 0.0.79 through npx -y to run it, with two scratch settings files written for its runs. The write probes inside the sandboxes were attempts, and the sandboxes refused them; the network probes were attempts that failed, for a cause the record does not establish. I changed no setting and granted or revoked nothing.¹⁹⁵ I describe what I found by app and service names. Where the evidence shows a program is in the Full Disk Access list, I say it is listed; I say it has access only where a read shows the access working.

The agent’s launch chain

The shell that Claude Code runs commands in is a zsh, started by claude, started by my login shell, started by login, started by Ghostty, the terminal app; the environment reports TERM_PROGRAM as ghostty.¹⁹ By Apple’s support engineer’s rule, the responsible code for anything in that chain is Ghostty.³

Reading the list

In what I checked, macOS documents no command that lists Full Disk Access holders: tccutil has exactly one command, reset.³⁴ The list lives in TCC’s databases. From the agent’s shell, the per-user database could not be opened, and its folder did not appear in a directory listing of the user’s Application Support folder. I do not know why. The macOS 27 release notes say “Apps can no longer access the local TCC database directly,” which may be the reason, but the note does not say which database it means, so I leave it unexplained.¹⁹²³

The system-wide database opened. I selected two columns only, the service and the client, filtered on the Full Disk Access service, and never read the column that records whether each switch is on. It returned 75 rows.¹⁹ Being able to open it at all is itself evidence. In 2022 Jeff Johnson showed that Terminal with Full Disk Access “can read or write any restricted files, including the TCC database itself”; he showed it for the per-user database, and the control test below shows the same for the system database on this Mac.⁴⁶⁵ It also means that on macOS 27.0, despite the release note quoted above, the system TCC database was still directly readable by a process whose launch chain held the grant.¹⁹²³

I sorted the 75 rows with one rule per kind, applied in order: the three terminal bundle IDs; any client path to a version-numbered Claude Code binary; the ChatGPT, Cursor and Xcode bundle IDs; any node or python3.x interpreter path; the SSH server’s client; any client that starts with com.apple. or /System/; my own development builds; and everything else.¹⁹⁴⁷ What is in each group:

• Terminals (3). Terminal, iTerm2 and Ghostty are all listed.
• Claude Code (30). Thirty separate rows, each the path to one version of the Claude Code binary, from 2.1.177 to 2.1.296, the version this session ran.¹⁹⁴⁷ Anthropic says that with the native installer, the background session host’s entry “appears as Claude Code and the grant persists across updates.”⁵¹ The database, on this Mac, stores one row per version. I did not check how System Settings displays them or whether each switch is on. My reading, unverified: these are the background session host’s requests, one per update.
• Agent hosts (3). The ChatGPT app (bundle ID com.openai.codex), Cursor, and Xcode.¹⁹⁴⁷ Xcode belongs here because Xcode 27 hosts agents: its release notes say “Agents in Xcode can now be extended with plugins that contain skills, MCP servers, and ACP agent configurations” and add support for the Agent Client Protocol.²⁴ Whether TCC charges the processes those agents spawn to Xcode is undocumented, and Xcode may not behave like a terminal. In 2024 Apple’s support engineer, asked why a tool’s own grant was honored only when Xcode ran it, answered that “Xcode runs the tool in a way that makes it clear to the system that Xcode is not the responsible code for this process”; looking at the chain under Xcode’s debugger, he wrote “I expect that one of these is breaking TCC’s responsible code search” and added, “I suspect that’s deliberate.”³ So Xcode is listed and hosts agents, but for the tools it runs, Apple’s engineer describes the opposite of the terminal rule.
• Interpreters (5). One Homebrew node and four Homebrew Python interpreters. Apple’s support engineer warns against exactly this: give the interpreter the privilege “then any script could do that.”²⁰ OpenClaw gives the same warning about node for Accessibility: treat such an entry “as broad permission for that Node runtime, not as permission for one npm package.”⁵⁰
• SSH (1). sshd-keygen-wrapper, the SSH server-side client, which I take to be the entry that “Allow full disk access for remote users” controls.¹⁹³
• Other Apple (3), my own builds (5), everything else (25). The last group includes disk and cleanup utilities, a security suite, VPN and cloud storage clients, updaters, printer software, games, a video-meeting app and a messaging app. A few are disk utilities, the other kind of software Apple names; none of the 75 is a backup app.

Forty-two of the 75 rows are something an agent can run under or through. None of them is a backup app.

Seven runs: the sandbox and the grant are separate layers

To see which layer decides, I ran one probe, a read of a single row from that system database, under different conditions, plus a write probe inside both sandboxes and a network probe inside sandbox-runtime.⁵

1. The agent’s shell, no sandbox. The read returned the row.
2. Inside Codex CLI 0.154.0’s Seatbelt sandbox, read-only mode. The read returned the row. The same sandbox refused a touch outside the workspace with “Operation not permitted” (run 2b), so the sandbox was working; it just does not stop reads there. With my own Codex configuration, which sets no sandbox mode and turns network access on, the read also returned the row (run 2c).
3. Inside Anthropic’s sandbox-runtime 0.0.79, the package Claude Code’s sandbox is built on, with no read denial (run 3a): the read returned the row, while the write outside the allowed folder was refused and a network request failed (curl exit 56; the record does not show why). With denyRead set to the TCC folder (run 3b), the read failed with “authorization denied.”
4. The control. The same sqlite3 read, submitted as a launchd job, so that neither Ghostty nor Claude Code was anywhere in its launch chain: “authorization denied.”⁵

The control is what makes the rest mean something. The database file is owned by root and readable by everyone by its mode (-rw-r--r--), so file permissions did not refuse run 4; TCC did.¹⁹⁵ The same binary, same file, same user, succeeded from the agent’s shell and failed outside it. What the agent’s shell had, it had from its launch chain. The support engineer’s rule names the terminal as that chain’s responsible code.³ One caveat I cannot remove with this data: the chain also contains a claude process, and Claude Code binaries are listed too; in runs 3a and 3b, a node process ran the sandbox runtime, and a Homebrew node is listed as well, though which node npx used is unrecorded. My measurement shows that the access comes from the chain, and the support engineer’s rule says the terminal; it does not separately prove that Ghostty’s row, rather than a Claude Code or node row, is the one TCC used. Apple’s support engineer says the algorithm is undocumented.³

Runs 3b and 4 print the identical error, though different layers refused them. An operator reading “authorization denied” in an agent’s output cannot tell from the message whether the sandbox or TCC said no.⁵

Try it on your own Mac

From the shell your agent uses, this prints the Full Disk Access list when that shell’s launch chain holds Full Disk Access. It fails with “authorization denied” when the chain does not, or when a sandbox rule denies the folder, as in run 3b. It reads two columns and changes nothing. The results are rows, not switch states.

# Run from the same terminal (or editor terminal) you run agents in.
sqlite3 -readonly "/Library/Application Support/com.apple.TCC/TCC.db" \
  "SELECT service, client FROM access WHERE service='kTCCServiceSystemPolicyAllFiles';"
echo "exit=$?"

This is the query I ran on macOS 27.0, word for word.¹⁹ To see which app TCC charged for an access, Apple’s deployment guide gives a log stream, log stream --debug --predicate 'subsystem == "com.apple.TCC" AND eventMessage BEGINSWITH "AttributionChain"', offered “to try to identify” the responsible app or binary in real time.³¹ I did not run it for these measurements, which is why section 5 cannot say whether Ghostty’s row or another in the chain decided. The database query above may stop working in a later release. Apple documents neither the file nor its schema, and the macOS 27 notes already say apps “can no longer access the local TCC database directly.”²³

6. What to do now

As of my October 11 reads, I found no published mechanism or release note for the new controls, so nothing here is a migration. It is what I would do on any Mac that runs agents, today, with the source for each step and what it costs. I have not done all of it on my own Mac yet; section 5 is the before picture.

1. See who holds Full Disk Access. Open System Settings > Privacy & Security > Full Disk Access and read the list.⁴ Look for terminals, editors, agent apps, agent binaries, interpreters and anything you do not recognize. From a shell, the query in section 5 prints the list if that shell already has the access, which doubles as a test of whether your agent’s shell has it; a failure can also come from a sandbox rule that denies the folder, as in run 3b.⁵ Cost: none. Remember that a listed app is not necessarily switched on.

2. Take it off the terminal you run agents in. This is the step that changes the most. A command-line tool’s responsible code is the terminal, so the terminal’s grant is the agent’s grant.³² If you need Full Disk Access for backup or admin work from the command line, which is what tmutil and fdesetup document it for, keep a second terminal app with the grant and never start an agent in it.⁴³⁴⁴ (That last part is my suggestion, not Apple’s. Jeff Johnson demonstrated with Apple’s Terminal that an unsandboxed app can borrow its grant by opening a script in it; by my reading, the same could apply to a second terminal app that opens scripts.⁴⁶) Cost: protected locations start failing with “Operation not permitted,” and Files & Folders prompts come back. Apple’s per-folder control covers “Desktop, Documents, Downloads, network volumes, and removable volumes.”¹⁰ Anthropic documents the same failure for Claude Code’s background sessions and the fix, a Files and Folders grant for that entry.⁵¹ OpenClaw suggests keeping files inside its workspace to avoid per-folder grants.⁵⁰

3. Check the agent’s own entries. Claude Code’s background host requests access “separately from your terminal” and can hold its own Full Disk Access entry.⁵¹ On my Mac, 30 version-numbered Claude Code binaries are listed, which I read, unverified, as that host’s entries.¹⁹ Remove the ones you did not mean to grant, and grant Files and Folders instead where a background session needs a folder. Agent apps hold rows of their own too; on my Mac the ChatGPT, Cursor and Xcode apps are all listed.¹⁹ Cost: a background session that reads protected folders fails until you grant the narrower access.

4. Never grant it to an interpreter. Apple’s support engineer: “if you have a script that needs to manipulate files on your desktop, you wouldn’t want to give the interpreter that privilege because then any script could do that.” His fix is to “package your script as a standalone program that MAC can use for its tracking.”²⁰ An interpreter’s own row counts wherever the interpreter is the responsible code, for example a script run as a launchd job with no app associated; then every Python or Node script, MCP servers included, launched that way through that interpreter gets the whole grant.³² Cost: for a script that truly needs the access, his “easiest solution” is to package it as a standalone program that MAC can track, which he says AppleScript makes easy and shell scripts do not.²⁰

5. Turn the vendor sandbox on, and deny the reads you do not need. The defaults read broadly, so turning the sandbox on is necessary and not sufficient.

• Claude Code: sandbox.enabled, then permissions.blockReadsOutsideWorkingDirectories (or sandbox.filesystem.denyRead rules), and "allowUnsandboxedCommands": false to remove the unsandboxed retry.¹⁵ Remember that the Read tool, hooks and MCP servers are outside it.¹⁵ Cost: tools that need other paths or hosts fail until you allow them, and every excludedCommands entry reopens the gap.¹⁵
• Codex: stay in workspace-write or read-only; avoid danger-full-access; add "deny" read rules to a permission profile, or, for a team, set permissions.filesystem.deny_read in requirements.toml, the admin-enforced file, so users cannot weaken it.¹⁶²¹ Cost: commands that need the network need approval or network_access.⁶⁰
• Gemini CLI: run with -s and SEATBELT_PROFILE=strict-open or strict-proxied, the two profiles the docs describe as restricting reads.¹⁷ Cost: those profiles restrict reads as well as writes, so tools that read outside the project fail under them until you choose a looser profile.
• Cursor: switch Read Access from System to Workspace; the setting needs Cursor 3.23 or later, and the Cursor on my Mac is 3.19.7.¹⁸⁴⁷ Cost: file reads outside the workspace ask first, and sandboxed commands see only the workspace, your Read Allowlist and the system paths common tools need.¹⁸
• VS Code: turn chat.agent.sandbox.enabled on; it covers Copilot Agent Host sessions only, “not the Local chat harness or the custom terminal tool override.”⁵⁹ Cost: commands that need paths or tools outside its defaults have to be allowed, and even then Microsoft says it is “not a virtual machine or user-account boundary” and leaves outbound network open by default, so it narrows the gap rather than closing it.⁵⁹
• Hermes Agent and OpenClaw: use a container backend. Hermes recommends one for production gateways; OpenClaw’s sandbox is off by default and is, in its words, “not a perfect security boundary,” though it says the sandbox “materially limits filesystem and process access.”⁶⁴⁶² Cost: commands run in the container lose unrestricted access to the host (Hermes describes the backends as isolating “agent commands from your host system”), but mounted or synchronized files stay reachable: Hermes’s Docker and Singularity backends use bind mounts, a “live host filesystem view,” its docker_volumes setting shares host directories, and OpenClaw’s workspace access can be ro or rw as well as the default none.⁶⁴⁶¹⁶⁶ The cost is supplying the files a task needs explicitly and auditing those mounts. What it does not cover: OpenClaw’s gateway stays on the host, so a configured iMessage channel keeps the Full Disk Access of the gateway’s process context; containerizing tools does not remove that exposure.⁶²¹⁴ Hermes’s iMessage skill lists host prerequisites (Messages signed in, imsg installed, Full Disk Access for the terminal); I found no Hermes page on how the skill behaves under a container backend.¹³

The limit: on my Mac, no sandbox changed the Full Disk Access grant; a sandbox blocked the protected read only when its profile denied that path by name, and the Seatbelt layers of Claude Code, Cursor’s CLI and Codex have each had published escapes, since fixed.^5676869

6. Put an agent that reads Messages in its own macOS user, or do without it. OpenClaw’s own deployment advice for its iMessage bot is “Use a dedicated Apple ID and macOS user so bot traffic is isolated from your personal Messages profile.”⁷¹ Make that user a Standard account: Apple says standard users “can install apps and change their own settings, but can’t add other users or change other users’ settings.”⁷² On my Mac, my user Library, Mail and Messages folders are readable only by me by their file modes, so a process running as another standard user is refused by ordinary file permissions before TCC is consulted; that is my inference from the modes, not a test I ran.¹⁹ Two caveats: Apple’s support engineer says Full Disk Access is “system wide,” not per user, so an app granted it in one account has it in every account; and Apple’s guide says the setting reaches “certain administrative settings for all users on this Mac.”²⁰⁴ Cost: a second login, a second keychain and set of settings, and an agent that cannot see your main account’s files unless you share them.

7. Turn off “Allow full disk access for remote users” if you do not need it. If you drive agents over SSH, the SSH server is the responsible code and this setting is its grant.³ On my Mac its client is listed.¹⁹ Cost: remote shells lose access to protected locations.

8. Keep per-action approval for anything that speaks as you. OpenAI: “Persistent approval removes your final chance to review a message before ChatGPT sends it as you. Use it only when you accept that risk.”²² Anthropic: keep bypassPermissions for “isolated environments like containers or VMs.”⁵³ Cost: more clicks, which is the point.

9. If you manage Macs, audit what your profiles grant. A Privacy Preferences Policy Control profile can grant SystemPolicyAllFiles to any bundle ID or path, a terminal included, and “The user isn’t prompted and can’t change this value.”²³⁷ On macOS 27, the per-app part of that payload is marked deprecated, and the declarative replacement has no Full Disk Access key.³⁷³⁸ I found no Apple-documented way for MDM to report Full Disk Access that a user granted by hand. Cost: the profiles you find may be load-bearing for a backup or security agent; Apple’s own example grants an organization’s app access “without prompting the user.”³¹

The loop engineering guide covers running agents unattended; every step above applies with more force when nobody is at the keyboard to read a prompt.

7. What could change: a reading, with conditions

Everything in this section is my reading of Apple’s words and of changes Apple has already shipped next to them. Apple has announced no mechanism, and I predict none. Each shape below is something the October 2 text allows, the evidence that makes it more or less plausible, and the condition under which it would touch agents.

A harder grant flow. The text’s own verbs are about granting: users “who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action,” and should “clearly understand these risks before granting such access.”¹ Apple has shipped consent-with-explanation before: macOS 27’s declarative app settings show users a consent prompt carrying an organization’s required justification before applying privacy defaults.³⁹³⁸ Condition: if the new control applies only to new grants, a terminal that already holds Full Disk Access keeps it, and agents run in it are unaffected until the user resets it. If it applies to existing grants, every terminal that holds Full Disk Access is affected too. The item says neither.

A narrower scope. Apple could leave the switch as it is and move data out from under it. Apple has redrawn these lines before: Catalina added Trash to what needs Full Disk Access, macOS 14 and 15 put app containers and group containers behind protections of their own, and macOS 27 denies other teams’ containers by default and lets XProtect restrict “app data that is commonly targeted by malicious software.”¹¹²⁰²³ Condition: if Apple moves Mail, Messages or Safari data behind a control of its own that Full Disk Access does not cover, the terminal path stops reaching them even where the terminal keeps Full Disk Access. The item does not mention narrowing; its phrase “this extraordinary level of access” describes the grant as it is.

A different treatment of inherited grants. The gap between “grant an app” and an agent that is a child of an app is the one this post is about, and Apple has two pieces in place that could address it. Xcode 27 already has “a new security layer that monitors and controls filesystem access by coding agents and any processes they spawn,” and macOS 27’s Endpoint Security adds es_new_descendants_client, which watches only “the entire subtree rooted at the calling process” and, per its header, “Does NOT require TCC approval,” though like es_new_client it requires the com.apple.developer.endpoint-security.client entitlement.²⁴²⁵ Apple’s support engineer added the latter to his file-permissions post on September 18, 2026.²⁰ Neither text connects to Full Disk Access. Condition, as my reading: a control on “an app” lands on the terminal, and every agent in it still inherits the result, unless Apple changes the responsible-code attribution its engineer calls undocumented and “subject to change,” or ties the new control to something like the descendants client. Neither text says it will.

Managed Macs. MDM can grant Full Disk Access today without prompting the user.³⁷ In macOS 27, the per-app part of that payload is deprecated and its declarative replacement has no Full Disk Access key.³⁷³⁸ Condition: if the “very explicit user action” applies to MDM grants, a silent grant by profile would no longer be possible; if it does not, managed Macs keep the silent path. Apple has said nothing on either point, and has not tied the macOS 27 deprecation to the October 2 item.

When. The item says “Going forward.” The macOS 27.2 beta 3 notes, for a beta dated three days after it, have nothing on it, and I found no macOS 27.1 entry in the October 11 releases feed or release-notes index: the feed lists 27.0.1 (September 28) and then 27.2 beta 3, the 27.2 betas having begun September 16, and the release-notes index lists only 27 and the 27.2 beta 3.⁶⁸⁷⁹ Apple put this year’s TCC deprecation, “Apps can no longer access the local TCC database directly,” in the macOS 27 release notes under a TCC heading.²³ Condition: if the new controls arrive in a release that has developer notes, those notes are where Apple put this year’s TCC deprecation, and I will read every macOS 27.x beta’s notes for a line. But macOS 27.0.1 has already shipped with no developer release notes at all, so a change could also land in a point release with no line in any notes page.⁷⁸ If they arrive with macOS 28, a WWDC session or a beta’s release notes is where Apple has described such changes before: WWDC19 for Catalina’s protections, the macOS 27 notes for this year’s TCC deprecation.¹¹²³ Either way, the steps in section 6 do not depend on the answer.

Key Takeaways

If you run agents on a Mac

• Apple said on October 2 that granting Full Disk Access will take “very explicit user action” and named AI agents as the reason. It gave no version, date or mechanism.¹
• Your command-line agent has whatever your terminal has. Apple’s man pages and its support engineer say the terminal is the responsible code; Apple documents no general rule.²³
• A vendor sandbox is not a Full Disk Access control. On my Mac, a protected read passed through Codex’s read-only sandbox and Anthropic’s sandbox runtime; only a read denial on the exact folder, or launching outside the terminal, stopped it.⁵
• Take Full Disk Access off the terminal you run agents in, never give it to node or python, and turn on read restrictions, not only the sandbox.²⁰¹⁵²¹
• If an agent reads Messages, give it its own macOS user, and keep per-send approval.⁷¹²²

If you build agents or agent apps

• Do not tell users to grant Full Disk Access to their terminal or agent process. Two vendors do today, for Messages.¹³¹⁴
• Apple’s documented path is a link to the pane, not a prompt; the switch is the user’s, and Apple says turning it on will take very explicit user action.²⁵¹
• Say in your docs what your sandbox reads by default. Codex’s docs say its sandbox “limits what it can touch (typically to the current workspace)”; its source and my runs show reads reaching well past the workspace.⁶⁰⁶³⁵

FAQ

What is Full Disk Access on a Mac?

A setting in System Settings > Privacy & Security that lets an app “access all files on your computer, including data from other apps (for example, Mail, Messages, Safari, and Home), data from Time Machine backups, and certain administrative settings for all users on this Mac.” Apps cannot prompt for it; the user adds them with the Add button, or an MDM profile grants it.⁴¹⁰²

What did Apple announce about Full Disk Access in October 2026?

A developer news item dated October 2, 2026, “Updates to Full Disk Access in macOS,” says Apple “will introduce additional controls” so that users who want to grant an app this access “can only do so with very explicit user action,” because “As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.” It names no macOS version, date or mechanism.¹

Does Claude Code or Codex get Full Disk Access from my terminal?

Yes, if the terminal has it. A tool run from a terminal is checked against the terminal; Apple’s eslogger man page says running it from “Terminal.app or a third-party terminal emulator” needs that app authorized, and Apple’s support engineer writes in a forum post, “The tool’s responsible code is Terminal.” On my Mac, a read needing Full Disk Access worked from Claude Code’s shell inside Ghostty and failed when launched outside it.²³⁵

Does the Claude Code or Codex sandbox stop an agent from reading my Messages?

Not by default. Both sandboxes use Seatbelt, which is separate from Full Disk Access. Claude Code’s sandbox is off by default and, when on, reads “Most of the machine.” Codex’s is on, and its read-only mode read a Full Disk Access-protected file on my Mac. Deny the reads explicitly: permissions.blockReadsOutsideWorkingDirectories in Claude Code, "deny" rules in a Codex permission profile.¹⁵²¹⁵

How do I see which apps have Full Disk Access?

Open System Settings > Privacy & Security > Full Disk Access.⁴ tccutil cannot list it; its only command is reset.³⁴ From a terminal that already has Full Disk Access, a read of the system TCC database lists the clients, as in section 5; a failure with “authorization denied” means either that your shell does not have the access or that a sandbox rule denied the read.¹⁹⁵

Should I remove Full Disk Access from Terminal?

If you run agents in it, yes. Keep a separate terminal with the grant for backup or admin commands such as tmutil, and never start an agent there. Expect Files & Folders prompts and “Operation not permitted” errors in the terminal you remove it from.⁴³¹⁰⁵¹

When will Apple’s new Full Disk Access controls ship?

Apple has not said. The October 2 item says “Going forward,” the macOS 27.2 beta 3 release notes do not mention it, and I found no macOS 27.1 entry in the October 11 releases feed or release-notes index: the feed lists macOS 27.0.1 (September 28), which shipped with no developer release notes, and then macOS 27.2 beta 3; the 27.2 betas themselves began September 16.¹⁶⁷⁸⁹

Sources