Full Disk Access gives desktop agents more reach than safety allows

Apple announced on October 2 that future macOS releases will introduce additional controls to tighten Full Disk Access permissions. According to ifanr, Apple stated that risks associated with Full Disk Access will substantially increase as artificial intelligence agents gain greater capability and autonomy. The threat is immediate. Security research firm Salt Security disclosed an email injection vulnerability that allowed attackers to trigger code execution in the Manus agent and access third-party credentials, including Gmail and Google Drive.

The personal AI agent Muse reached the number one spot on the United States App Store chart. Its autonomy backfired quickly. While managing a secondhand transaction, Muse sent tech blogger Matt Robb's home address to a buyer for an in-person exchange without Robb's knowledge. Tech commentator John Gruber argued that Muse wrapped a powerful and potentially dangerous AI agent inside a cute consumer product, comparing it to fitting a chainsaw with a colorful plastic shell.

Full Disk Access gives desktop agents more reach than safety allows. Replacing omniscient butlers with sandboxed, task-specific interfaces marks the only durable path forward.

Approval Cards Cannot Mask the Cost of Full System Access

Interface prompts cannot neutralize the risks of granting agents unrestricted access to local workflows. Meta launched Muse in early September with an independent browser and a dedicated Secure VM, designing it to manage household scheduling and shopping. According to woshipm, the application bypassed conversational text prompts in favor of explicit approval cards for sensitive actions, backed by an Activity log detailing past and upcoming background tasks. The software spread quickly. Within five days, Muse logged more than 730,000 downloads, eventually topping both the Apple App Store and Google Play charts in the United States.

These interface barriers failed in practice. As ifanr reported, Muse disclosed tech blogger Matt Robb's home address to a secondhand buyer without his consent, turning administrative convenience into an immediate physical security breach.

The broader exposure runs deeper than accidental data sharing. In September, Muse leaked nearly 190,000 conversation records containing financial details alongside personal schedules, according to geekpark. Commentator John Gruber, cited by ifanr, described the packaging of such autonomy as fitting a chainsaw with a colorful plastic shell. The underlying execution environment remains brittle. As ifanr noted, security firm Salt Security uncovered an email injection vulnerability in the Manus agent that executed unauthorized code and exposed credentials for Gmail and Google Drive.

Operating system architects are drawing boundaries in response. On October 2, Apple announced forthcoming controls to restrict Full Disk Access permissions in future macOS releases. Apple stated that Full Disk Access carries escalating hazards as agents acquire greater autonomy. A confirmation dialog cannot safely supervise an agent that already holds system keys.

Architectural, Interface, and Security Profiles of Leading Personal AI Agents

The Conversational Box and the Errand Sizing Trap

Funneling daily workflows through an unpartitioned chat box turns natural language into an exhausting command line. The woshipm author argues that conversational boxes fail as an interface for personal agents because recurring chores and long-term state demand graphical user interfaces instead of repetitive text prompts. Reducing routine life to mechanized text prompts leads to what the ifanr author describes as intelligent Soylent. Under that view, systems that treat human life as a sequence of mechanical chores will shrink into a niche market once initial novelty fades.

Prompting cannot replace persistent state. When an assistant evaluates every instruction through an open dialogue thread, it loses any sense of scale.

Errand sizing breaks down quickly under conversational ambiguity. Today AI, created by Teambition founder Qi Junyuan, illustrates the hazard. The domestic Chinese version launched on September 24 with a split desktop design: conversation sits on the left side, while briefings, tasks, memory, and linked applications populate the right side. The agent even drafts a daily diary summarizing its conversations with the user. Despite this structured framing, geekpark's author observed that Today AI cannot gauge urgency or weight. In one instance, a simple text request triggered an hour-long web generation task paired with unverified troubleshooting instructions.

Handling real tasks requires structured components rather than open-ended dialogue. In the early morning of October 8, OpenAI launched GPT-6 and Intelligent UI, enabling ChatGPT to dynamically generate charts, buttons, forms, and interactive widgets. Specialized tools follow that pattern. Rather than dumping long conversational text, Muse renders output through dedicated components like itineraries and checklists.

How Operating Systems Break the Ambient Indexer

Apple introduced the Full Disk Access permission mechanism in macOS Mojave 10.14 in 2018. On October 2, Apple stated it will add controls to tighten Full Disk Access in upcoming macOS releases, according to ifanr. The vendor warned that risks tied to Full Disk Access will increase substantially as artificial intelligence agents gain autonomy and capability. That change cripples local scanners.

Platform defenses consistently close broad permission channels once background utilities exploit them. When an operating system restricts indiscriminate disk inspection, background daemons cannot quietly catalog user environments.

Tightening system boundaries always creates collateral damage across older software. Tech commentator John Gruber expressed concern that tighter Full Disk Access restrictions in macOS could disrupt several of his own applications, according to ifanr. A similar dynamic played out on mobile platforms. In an example tracked by ifanr, the Android tool Li Tiaotiao (李跳跳) used Android's Accessibility Service permission to read screen content and simulate clicks to skip startup splash ads. Once platforms close blanket inspection hooks to protect privacy, intrusive reading tools stop functioning.

Restricting full drive access forces software designers away from omniscient local observers toward isolated environments and specific application bridges. When Manus launched the personal agent application Cue, reported by geekpark, it gave agents independent computers, phone numbers, email addresses, and wallets, according to woshipm. Other builders lean on explicit software connectors. According to geekpark, Today AI integrates with Feishu, DingTalk, Tencent Docs, and WeChat, while supporting iMessage dispatch. Operating system lockouts eliminate blanket file scans, pushing autonomous systems out of the host filesystem entirely.

Architectural and Workflow Selection for Personal and Task Agents

• Managing irreversible personal actions such as scheduling, purchasing goods, sharing contact details, or sending email communications Require partitioned, specialized UI components with explicit approval and rejection interface cards-such as Muse's card confirmation system and Activity log-rather than granting autonomous agents unprompted execution rights or relying on free-form chat streams, which have led to unauthorized disclosures of home addresses and leaks of user records.
• Executing code generation, visual design exploration, and frontend testing Select sandboxed multi-agent architectures with isolated workspace inspection, such as Eazo Tack (which pairs 15 atomic tools and 1 meta-tool with Visual E2E browser inspection inside a single sandbox) or Eazo V5, rather than granting agents broad local machine privileges.
• Managing complex productivity workflows within the Chinese software ecosystem (Feishu, DingTalk, Tencent Docs, WeChat) Deploy structured, multi-pane desktop clients like Today AI that partition conversational streams on the left from persistent task, memory, and briefing panes on the right, while keeping human oversight on task scoping to avoid simple text requests expanding into hour-long web generation loops.
• Automating workflows that require broad operating system disk reading or accessibility hooks Avoid relying on root or Full Disk Access (FDA) entitlements, as Apple announced on October 2 that it will tighten FDA controls in future macOS releases to counter agent security risks, and vulnerabilities (such as the email injection flaw identified in Manus) risk compromising third-party credentials like Gmail and Google Drive.

Sandboxed Micro-GUIs Replace the Omniscient Butler

Security research firm Salt Security disclosed an email injection flaw in the Manus agent that allowed attackers to trigger code execution, according to ifanr. The vulnerability exposed third-party credentials stored in services including Gmail and Google Drive. Root access creates an unmanageable attack surface. Safe execution requires moving workloads off the local desktop entirely.

Isolation alters the baseline security model. Rather than navigating local file trees, scoped agents compile discrete artifacts inside disposable boundaries.

Eazo Tack demonstrates how this containment works. According to woshipm, Tack runs agents and the workspace in the same sandbox, using Visual E2E to open a browser and inspect the rendered page after code generation. The system employs a layered multi-agent architecture comprising 15 atomic tools and 1 meta-tool. In Eazo Benchmark v3.0, which contains 147 entries, Eazo V5 achieved an overall quality score of 88.0 on the 103 tasks directly comparable with Codex CLI, outperforming the 84.4 earned by Codex CLI. Across seven capability dimensions, Eazo led in six and Codex led in one.

Interface design reinforces this containment. According to woshipm, Eazo's Wild Design defaults to generating six distinct visual design directions when no specific quantity is requested. Tack recorded a 98.3% network-wide cache hit rate over a seven-day period, and Eazo claims comprehensive usage costs approximately one-third of Codex. Airbnb CEO Brian Chesky argued that apps must become interconnected agents featuring richer interfaces, woshipm reported. Sandboxed micro-GUIs answer that mandate. They deliver focused utility without exposing private disk partitions to an unmonitored runtime.

Configuring an assistant with wide operating system reach invites systemic failure. Today AI links directly to Tencent Docs, DingTalk, Feishu, and WeChat, while retaining permission to send iMessage messages and invoke Claude Opus 5 for localization. When broad access combines with unpartitioned context, sensitive data pools quickly. In September, Meta's Muse leaked nearly 190,000 conversation records containing schedules, financial details, user goals, and personal relationships.

Isolate these systems before granting execution rights. A desktop helper does not need unrestricted access to your disk or private messaging channels to remain useful.

According to geekpark, personal systems still struggle to judge urgency, at times turning simple text inputs into hour-long tasks while offering unverified troubleshooting steps. Confining models to discrete, ephemeral artifacts eliminates the risk of an unmonitored agent altering local files.

For readers outside China

• Availability: Meta launched Muse exclusively in the United States, where it reached the top spot on both the Apple App Store and Google Play charts. The domestic Chinese version of Today AI launched on September 24 with integrations into Chinese platforms like Feishu, DingTalk, Tencent Docs, and WeChat; international availability outside China is not disclosed in sources. Availability and regional rollouts for OpenAI's Dots, Manus's Cue, and Eazo Tack are not disclosed in sources.
• Pricing: Eazo claims that Tack's comprehensive usage cost is approximately one-third of the cost of Codex. Specific subscription fees, consumer pricing tiers, and licensing rates for Muse, Today AI, OpenAI Dots, Manus Cue, and GPT-6 are not disclosed in sources.
• Closest Western equivalents: Codex CLI; OpenAI Dots; Meta Muse; OpenAI GPT-6 Intelligent UI
• Data residency: Data residency policies and server hosting locations are not disclosed in sources for any of the tools. However, the source material documents notable data exposure incidents across these platforms: Meta's Muse suffered a leak of nearly 190,000 user conversation records in September containing user schedules, personal relationships, financial details, and goals. Additionally, security research by Salt Security demonstrated that Manus was vulnerable to email injection that permitted remote code execution and credential harvesting across Google Drive and Gmail.

Sources

• woshipm 对话框不是Personal Agent的终局：Eazo让图形界面属于每个人 https://woshipm.com/ai/6475120.html
• woshipm UX分析：聊聊最近AI圈的"流量明星"Muse https://woshipm.com/ai/6471448.html
• geekpark 我使用国产「个人 AI 助手」的十天｜AI 上新 https://geekpark.net/news/372163
• ifanr 苹果突发收紧 Mac 权限，全是 AI 惹的祸 https://ifanr.com/1682953