Most platform-policy news does not belong in a hiring conversation. This one does, for a reason that took me a day to articulate: Apple has just described a thing that is sitting, right now, on a large share of the developer laptops in Singapore, including on machines belonging to contractors whose setups you have never seen, and has said it constitutes a risk serious enough to change the operating system over. That makes an invisible practice visible, and anything that becomes visible becomes something you can interview for.
What Apple Said on 2 October
Reported by Sarah Perez for TechCrunch on 2 October 2026 under the headline âApple says itâs tightening macOS âFull Disk Accessâ controls due to new risks from AI agentsâ, Apple confirmed it will introduce new controls around the Full Disk Access permission to restrict how AI agents reach user data, and that it intends to require âvery explicit user actionâ before such access is granted.
The companyâs own framing is unusually blunt for a privacy statement:
âSome developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systemsâŚwithout usersâ full knowledge and understanding.â
And on the trajectory:
âAddressing this is critical. As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially.â
The immediate trigger was Metaâs Muse, with the report also noting previously disclosed security flaws around ChatGPTâs Mac app. Critically, the permission in question is not scoped to a project folder: Full Disk Access reaches files, mail, messages and even browsing history. No macOS version was named, and no implementation detail was published. Source: TechCrunch, 2 October 2026.
Our expert take #1
Nothing about Full Disk Access changed. What changed is what asks for it. That permission has existed for years, and historically the applicants were backup tools, antivirus and developer utilities, software that did one predictable job, where a user handing over broad read access received something broadly useful and bounded in return. An autonomous agent inverts the deal: you give it a goal, it decides what to read, and it can act on what it finds. The same checkbox now authorises an open-ended search of your filesystem by a process whose next action you cannot enumerate in advance. Apple is not reacting to a new vulnerability. It is reacting to the realisation that a consent model designed for predictable tools is being used to authorise unpredictable ones. For an engineering leader, that is the whole lesson: your permission inventory was written for a category of software that no longer describes what is installed.
Why This Lands Harder in Singapore Than the Headline Suggests
Two local factors make this more than a tooling footnote.
The first is what is actually on a developer Mac in Singapore. In a market where a large share of engineering work sits in fintech, healthtech, logistics and government-adjacent delivery, the laptop that has an AI agent installed is frequently the same laptop that has, somewhere in a downloads folder, a two-year-old production export, a customer spreadsheet pulled for a migration, and a database dump someone needed on a Friday. Full Disk Access does not distinguish between a repository and that folder. It also reaches mail and messages, which is where the data you have no record of lives.
The second is the PDPA framing. The question an inquiry asks is not âwas this tool on the approved listâ. It is whether personal data was disclosed to a third party without a lawful basis, and whether reasonable security arrangements were in place. An agent that reads a customer spreadsheet and transmits context to a vendor API is a disclosure, whatever the internal procurement paperwork says. The internal approval tells you about your process; it does not answer the question that gets asked. If you engage developers outside Singapore, the same analysis applies with an extra hop, PDPA compliance for offshore developers covers that shape of problem in detail.
Hiring engineers who will be running agents on your data?
We place developers and AI engineers for Singapore employers, and we can build the permission-scope question into the screen so you are not relying on it coming up by accident.
Discutons-en, talk to our Singapore teamThe 5 Questions I Added This Week
To be clear about the goal: I am not trying to hire a security specialist into every seat, and these questions are not a security interview. They take about two minutes inside interviews we already run, and they filter for one specific disposition, whether a candidate has ever treated a permission prompt as a decision rather than as an obstacle between them and a working tool.
1. âWhich AI tools are installed on the machine you work on, and what can each of them actually read?â The first half is easy and everyone answers it. The second half is the question. A candidate who has to think, then says something like âhonestly, probably more than it needsâ, has given a better answer than one who says âjust my projectâ confidently and incorrectly.
2. âWhat is the narrowest permission that would still let that tool do its job?â This tests whether they have ever considered the question at all. Strong answers are specific: a single directory, a read-only mount, a container, a separate account without mail configured.
3. âHave you ever declined to install one of these tools, or turned a permission down? What happened?â My favourite of the five, because it is hard to rehearse and it surfaces real experience. The answer I want includes some mild irritation, the candidate wanted the tool, thought about it, and accepted a worse workflow. That is the behaviour you are hiring.
4. âIf an agent on your laptop read a file it should not have, how would anyone find out?â This moves from prevention to detection, which is where the expensive gap usually is. Most honest answers are âwe would notâ, and a candidate who says that plainly is more useful than one who invents a monitoring story.
5. âWhere does customer data end up on a developer machine in a normal week?â The systems question. Good engineers answer with the mechanism, a debugging export, a support escalation, a migration dry run, because they have seen it happen. It also tells you whether they think of themselves as part of a data path.
Our expert take #2
The answer pattern that should worry you is not ignorance, it is fluency without scope. I have interviewed candidates who can describe agent architectures in detail, name six tools, discuss context windows, and then cannot tell me what the agent on their own laptop is able to read. That combination is more dangerous than a candidate who has never used one, because it arrives with authority and gets deferred to in design reviews. Conversely, the answer I have learned to value most is the unglamorous one: âI gave it a folder, it was annoying, I left it that way.â There is no sophistication in that sentence and it is exactly the instinct that keeps a Singapore engineering team out of a disclosure conversation. If you want a deeper version of this assessment for roles where agents are the actual product, evaluating AI agent security skills goes several levels further than five interview questions can.
The Part Nobody Has Visibility Into: Contractor Laptops
If you engage contractors or an offshore team on their own hardware, this is where your actual exposure sits, and it is the hardest to see.
On a bring-your-own-device arrangement you do not control the endpoint. You cannot enumerate what is installed, you have no way to query which applications hold broad filesystem access, and you will not be told when that changes. If the same machine holds a repository clone, a mail client and a few historical exports, an agent with Full Disk Access on it reaches your data along a path you have never inventoried.
Apple requiring a more explicit grant helps at the margin, because it makes the moment of consent visible to the person granting it. It does nothing to make that visible to you. The fix is contractual and architectural rather than technical: name which categories of tool may hold broad access, require that work happens inside an environment you provision rather than on a personal filesystem, and put the question into onboarding instead of discovering it during an incident. The onboarding mechanics are covered in onboarding remote developers in Singapore, and if the engagement model itself is the thing you are deciding, staff augmentation in Singapore sets out where the endpoint responsibility sits under each option.
What I Would Not Conclude From This
Three cautions, because this is the kind of story that gets over-read in both directions.
It is not a reason to ban AI coding agents. Teams that ban them get shadow installs, which is strictly worse: the same permission granted on the same machine with no record and no conversation. The goal is scoped access and a known inventory, not abstinence.
Apple has not shipped anything yet. No macOS version was named and no implementation detail was published. Anyone telling you precisely how the new flow will behave is guessing. What is firm is the direction and Appleâs own characterisation of the current situation as a risk.
This is not primarily a security-team problem. It is a default-settings problem, which makes it an engineering-management problem. The grant was made by a developer in a hurry on a Tuesday, for a sensible reason, and nobody revisited it. That is why a two-minute interview question and a one-afternoon audit beat a policy document. Where agents are the product rather than the tooling, the structural version of this sits in building an agentic AI engineering team in Singapore.
Our expert take #3
If you do one thing from this article, do the audit before the interviews. Pull a list of which applications currently hold Full Disk Access across your managed Singapore fleet, and look at what is in the home directories of the three longest-serving developers. I have suggested this to several engineering leads and the result is consistent: the permission list contains something nobody remembers approving, and the downloads folders contain customer data from a project that closed. Neither finding is a scandal and both are completely ordinary, which is the point. You need that concrete result before the hiring change makes sense to anyone, because an abstract warning about agent permissions sounds like compliance theatre, and âwe found a 2024 production export on a laptop with an agent installedâ does not. One afternoon, and it converts this from a news story into a decision your team will actually back.
The permission was granted on a Tuesday. Nobody revisited it.
We place developers and AI engineers for Singapore employers and screen for the habits that keep your data out of a disclosure conversation.
Discutons-en, brief our Singapore teamFrequently Asked Questions
Why is Apple tightening Full Disk Access now?
Because the thing asking for the permission changed. Full Disk Access has existed for years and was mostly requested by backup tools, antivirus and developer utilities, where a user granting broad read access got something broadly useful in return and the software did roughly one predictable job. An autonomous agent is a different proposition: it is given a goal rather than a task, it decides what to read, and it can act on what it finds. Apple put this plainly on 2 October 2026, saying that some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems without users having full knowledge and understanding, and that as AI agents become more capable and autonomous the risks associated with that level of access will grow substantially. The permission did not get more dangerous. The software holding it did.
Does this affect Singapore companies whose developers use AI coding agents?
Almost certainly, and the exposure is usually larger than people expect because the grant is old and nobody re-examined it. A developer Mac holding Full Disk Access for an agent exposes far more than a source tree: mail, messages and browsing history sit inside the same permission, alongside whatever production exports, customer CSVs and database dumps have accumulated in a downloads folder over two years. Under the PDPA the question is not whether a tool was approved but whether personal data was disclosed to a third party without a lawful basis, and an agent that reads a spreadsheet of customer records and sends context to a vendor API is a disclosure regardless of how the permission was framed internally. The immediate action is not to ban anything. It is to find out which machines currently hold the grant and what is reachable from them, which is usually a short exercise that produces at least one unwelcome answer.
Should this change how we interview engineering candidates?
It should change one small part of it, and the change is cheap. You are not trying to hire security specialists into every seat. You are trying to filter out the much more common candidate who treats a permission prompt as an obstacle between them and a working tool. The useful questions are concrete rather than theoretical: what does the agent you use actually have access to on your machine, what is the narrowest permission that would still let it do its job, and have you ever turned one of these tools down. A strong answer describes a scoped directory, an explicit decision and some irritation at having had to make it. A weak answer is a brand name and the words âit just needs accessâ. Two or three minutes inside an existing interview is enough, and it predicts behaviour on day one better than most of what sits around it.
What about contractors and offshore developers on their own laptops?
This is where the risk concentrates, and it is the part most Singapore engineering leads have least visibility into. On a bring-your-own-device arrangement you typically do not control the endpoint, cannot enumerate what is installed, and have no mechanism to see which applications hold broad filesystem access. If that machine also holds a repository clone, a mail client and historical exports, then an agent with Full Disk Access on it reaches your data through a path you have never inventoried. Apple requiring a more explicit grant helps a little, because it makes the moment of consent visible to the person doing it, but it does nothing to tell you after the fact. The practical fix is contractual and architectural rather than technical: specify which tools may hold broad access, require that work happens inside an environment you provision rather than on a personal filesystem, and treat the question as part of onboarding rather than as an incident response topic.
Sebastian
Mobile App & Hiring Expert at HireDeveloper.sg. Follows platform and tooling changes that alter what Singapore employers should test for, and translates them into interview questions that fit inside an existing process.