Apple clamps AI disk access as local agents gain traction

Apple tightens Full Disk Access for AI agents in macOS 27.3

Apple announced that macOS 27.3 will restrict Full Disk Access requests from AI agents. The change follows reports of agents slipping past user consent and exfiltrating files. 9to5Mac says the update will require explicit user approval for any agent that wants to read or write outside its sandbox. The rollout is slated for the next quarterly release, but Apple has not disclosed the exact date.

The policy targets background services that invoke the new “AI Agent” entitlement. Developers will need to declare the entitlement in their code signature and present a system dialog that explains the scope of access. Apple’s documentation warns that misuse could trigger revocation of the entitlement. The move signals a shift from the permissive model that allowed agents to inherit user privileges by default. Critics argue the change may break existing automation scripts that rely on silent disk access.

Familiar: an open‑source local AI agent for macOS and iOS

Last week a Hacker News user released Familiar, an open‑source macOS app that runs LLMs locally and exposes them as agents. The author tested Qwen 3.5 9B on an M1 Pro and demonstrated a tool‑calling workflow that listed files and renamed matches. The demo stayed offline, never contacting a cloud endpoint.

Familiar’s codebase bundles Qwen 3.5 Small (0.8B‑9B series released early March 2026) and Microsoft’s Phi‑4‑mini (3.8B). Both models run comfortably on Apple silicon without exceeding thermal limits. The author notes that a 3‑5 billion‑parameter model can handle file‑management tasks, document summarization, and simple automation when paired with well‑defined tools.

The project positions itself as a hybrid workflow: local models handle private data, while cloud APIs are called for heavy‑weight reasoning. The author predicts this split will become the default within two years as hardware improves and tool‑calling APIs mature. The approach sidesteps the privacy concerns that prompted Apple’s upcoming macOS changes.

SmolVM: sandboxing agents with lightweight virtual machines

Celesto’s SmolVM offers another angle on the privacy‑security dilemma. It creates a disposable Linux VM that runs inside a macOS or Linux host. The VM boots in roughly 500 ms and presents a separate “computer” to the AI agent. All code execution, web browsing, and desktop automation happen inside this container.

Because the agent never runs as a native process, the host OS maintains a stronger boundary. Files created inside the VM stay isolated unless the user explicitly exports them. Celesto’s CLI and Python SDK let developers script the lifecycle: celesto computer start my‑agent, run commands, then celesto computer stop my‑agent to discard state. The documentation warns that telemetry is sent unless disabled, but the data payload is limited to installation counts.

SmolVM’s design aligns with Apple’s intent to limit unchecked disk access. By forcing agents into a sandbox, the system can audit every file operation. The trade‑off is added latency and the need to manage a separate filesystem image. For developers who already run agents on remote servers, SmolVM provides a local testbed that mirrors production constraints.

Polaris: on‑device data collection for training AI agents

Polaris is an open‑source framework that captures screen, keystroke, and mouse data on macOS. The tool is meant to feed real‑world interaction logs into on‑device training pipelines. Users start a capture from the menu bar, and the software writes timestamped recordings to a user‑specified folder.

Polaris emphasizes privacy. It runs “as is” without warranty and requires explicit user consent before any data is recorded. The project relies on SwiftAutoGUI and Swift‑Keylogger libraries, both of which are publicly available on GitHub. The framework does not transmit data off the machine unless the user builds that step into their pipeline.

The utility fills a gap for developers who want to fine‑tune local models on personal workflows. By keeping the raw interaction data on the device, Polaris avoids the data‑exfiltration risk that Apple’s new macOS policy seeks to mitigate. However, the framework also raises questions about consent management and the legal responsibilities of developers who distribute trained models derived from captured user data.

Industry context: balancing privacy, convenience, and compute

Apple’s Full Disk Access clamp arrives at a moment when local AI agents are gaining traction. The shift toward on‑device inference is driven by cost concerns, intermittent connectivity, and the desire to keep sensitive files private. Projects like Familiar and Polaris demonstrate that the hardware exists to run modest‑size models without cloud assistance.

At the same time, sandbox solutions such as SmolVM illustrate a complementary strategy: isolate agents that need broader system privileges. The sandbox model mirrors the principle behind Apple’s entitlement system—grant the minimum necessary rights and require user affirmation for anything beyond.

The tension lies in developer ergonomics. Requiring explicit dialogs for every disk operation could frustrate power users who automate repetitive tasks. Sandboxing adds complexity to the tool‑chain and may double the storage footprint for temporary state. Meanwhile, on‑device training frameworks need large, high‑quality interaction logs, which are hard to collect without invasive monitoring.

Regulators are watching the same space. The European Union’s AI Act proposes strict data‑handling rules for high‑risk AI systems, including requirements for transparency and user consent. Apple’s move can be read as a pre‑emptive compliance step, while open‑source projects must navigate the same legal landscape without the resources of a Fortune 500 company.

What to watch

Watch the macOS 27.3 public beta for the exact wording of the new AI Agent entitlement dialog. Track whether third‑party agents adopt the sandbox model or request full disk rights under the new rules. Monitor the adoption rate of open‑source local models like Qwen 3.5 Small and Phi‑4‑mini on Apple silicon, especially in workflows that combine Familiar with Polaris data pipelines. Finally, keep an eye on EU regulatory guidance that could force additional consent mechanisms for on‑device data collection.

Updates

• 2026-11-12 — President Trump calls on Tim Cook to be next NVIDIA CEO (source)