Apple 调整完全磁盘访问权限，以遏制 AI Agent 滥用

英文标题：Apple changes full-disk access permissions to curb abuse from AI agents

Apple 表示将修改 macOS 隐私设置，防止第三方应用开发者滥用“完全磁盘访问”权限读取用户消息记录。此举发生在 Meta 的通用 AI Agent Muse 被指未经用户明确授权读取 Apple Messages 对话两周后。Meta CTO David Singleton 称，Muse 读取 Messages 内容需要用户同时授予 macOS 完全磁盘访问权限并启用 Muse 中的 Messages 连接器；但 macOS 安全专家 Patrick Wardle 质疑，仅凭完全磁盘访问权限，应用在技术上已可读取聊天记录、浏览器历史和 Cookie 等大量数据。事件凸显，开发者和用户在向 AI Agent 开放日历、邮件、消息及购物账户等敏感资源时，需要更严格的权限控制与可见性机制。

打开原文相关 3 · 机会 1

中文

Apple 表示，正在调整 macOS 隐私设置，以阻止第三方应用开发者滥用这些设置访问用户消息历史记录。

周五的公告发布于两周后。当时，科技专栏作家 Jason Aten 表示，Meta 新推出的通用 AI Agent Muse 向他发送了一条未经请求的通知，其中提及了他与同事通过 Apple Messages 进行的一段对话。Aten 表示，他从未授予 Muse 读取其消息的权限，并且一直认为这些内容不在其访问范围内。上周，社交媒体因此事件炸开了锅，许多人表示认同，并称这一事件表明：获准访问日历、电子邮件、消息、购物账户及其他资源的 AI 助手，就像圆锯或其他电动工具一样。它们或许很有用，但如果使用不慎，也可能造成真正的伤害。

各执一词

Meta CTO David Singleton 加入了这场争论，并作出了看似有力的反驳。要让 Muse 访问 Apple Messages，用户必须手动授予它两项权限。其中一项是“完全磁盘访问”（full-disk access），这是一项 macOS 系统级权限；另一项是在 Muse 中启用 Messages 连接器设置。

“Muse Mac 应用中的 Messages 集成需要由用户主动选择启用，”Singleton 表示。“只有在授予 macOS 系统级完全磁盘访问权限，并启用 Messages 连接器后，您的 Muse 才能读取 Messages 内容。”

Singleton 的暗示很明确：Muse 只有在 Aten 启用了这两项设置的情况下，才能读取他的 Messages 通信内容；如果确实如此，那么这位专栏作家只能怪自己——当然不能怪 Meta。

本周早些时候，我与 macOS 安全专家 Patrick Wardle 交谈，他对 Singleton 的否认提出了质疑。他的理由是：“从技术角度来看，拥有 FDA（完全磁盘访问）后，任何（非 root）文件都可以被读取，包括浏览历史、浏览器 Cookie、聊天记录等等。”我询问 Meta：既然每个拥有该权限的应用都能读取消息，为何 Muse 在拥有完全磁盘访问权限时却不能读取消息？Meta 公关部门唯一的回应，是再次引用 Singleton 的说法：“Muse Mac 应用中的 Messages 集成需要由用户主动选择启用。只有在授予 macOS 系统级完全磁盘访问权限，并启用 Messages 连接器后，您的 Muse 才能读取 Messages 内容。”

English / 原文

Apple says it is changing its macOS privacy settings to stop third-party app developers from misusing them to access message histories.

Friday’s announcement comes two weeks after tech columnist Jason Aten said that Meta’s new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permissions to read his messages and had assumed they were off-limits. Social media last week blew up with masses of people who agreed and said the incident showed that AI assistants given access to calendars, emails, messages, shopping accounts, and other resources are akin to a skill saw or other power tool. While potentially useful, they can do real damage if not used carefully.

He said/she said

Meta CTO David Singleton joined the fray with a rebuttal that appeared solid. For Muse to access Apple Messages, a user must manually give it two privileges. One is full-disk access, a macOS system-level permission. The other is to enable a Messages connector setting in Muse.

“The Messages integration in the Muse Mac app is opt in,” Singleton said. “Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled.”

Singleton’s implication was clear. Muse could have read Aten’s Messages communications only if he had enabled both settings, and if so, the columnist had only himself—and certainly not Meta—to blame.

Earlier this week, I spoke to macOS security expert Patrick Wardle, who questioned Singleton’s denial. His reasoning: “From a technical point of view, with FDA (full-disk access), any (non-root file), is readable, browsing history, browser cookies, chats, etc etc etc.” I asked Meta how Muse couldn’t read messages when the app had full disk access, while every other app with that privilege could. Meta PR’s only response was to requote Singleton saying: “The Messages integration in the Muse Mac App is opt-in. Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled.”