PTIR — Daily Briefing — 2026-10-03
by
Executive Summary
Apple has acknowledged that Full Disk Access can expose files, mail, messages, browsing history, and other app data, and that increasingly autonomous AI agents make that privilege substantially riskier. Apple promises additional controls but has not provided a release date, so the useful action today is to audit existing grants rather than wait for the operating system to intervene.
Separately, administrators of Fortinet FortiMail should treat CVE-2026-104286 as an immediate incident-response item. The unauthenticated path-traversal flaw is in CISA’s Known Exploited Vulnerabilities catalog with an October 4 remediation date.
Action Queue
1. Audit macOS Full Disk Access before trusting another agent
Apple’s October 2 developer notice says Full Disk Access largely bypasses normal privacy controls and can expose essentially the entire Mac. The company specifically warns that the risk grows as AI agents become more capable and autonomous.
Action: Open System Settings → Privacy & Security → Full Disk Access. Remove any app that does not have a current, specific need for whole-disk access. Give extra scrutiny to AI agents, communication clients, automation tools, terminal utilities, and abandoned backup software. Repeat the review for Accessibility, Automation, Input Monitoring, and Screen & System Audio Recording when an agent combines those permissions.
- Urgency: Immediate
- Importance: ★★★★★
- Verified active: October 3, 2026
- Deadline: No announced rollout date for Apple’s additional controls
- Cost: Free
- Requirements: A Mac and administrator access to change privacy settings
- Official notice: Updates to Full Disk Access in macOS
- Official settings guide: Change Privacy & Security settings on Mac
2. If FortiMail is present, mitigate CVE-2026-104286 and preserve evidence
CVE-2026-104286 is a critical, unauthenticated path-traversal vulnerability that can permit arbitrary file writes through crafted HTTP or HTTPS requests. CISA lists it as known exploited and sets October 4, 2026 as the remediation date. Affected branches include FortiMail 7.2, 7.4, 7.6, and 8.0 releases identified in the vendor advisory.
Action: Inventory internet-facing FortiMail immediately, follow Fortinet’s mitigation or upgrade guidance, restrict management exposure, and preserve relevant logs and forensic evidence. If mitigation is unavailable, follow CISA’s direction to discontinue use rather than leave an exposed system online.
- Urgency: Immediate
- Importance: ★★★★★ for FortiMail operators; otherwise not applicable
- Verified active: October 3, 2026
- Deadline: October 4, 2026
- Cost: No charge to apply configuration mitigations; upgrade/support entitlement may depend on the deployment
- Requirements: Administrative access to FortiMail and the ability to investigate possible compromise
- Vendor advisory: Fortinet PSIRT FG-IR-26-175
- Federal catalog: CISA Known Exploited Vulnerabilities — CVE-2026-104286
PKb Candidates
Treat Full Disk Access as delegated root-adjacent authority. Record why each grant exists, the owner who approved it, the date it was last reviewed, and the minimum companion permissions the workflow actually needs. Re-audit after installing an agent or materially changing its capabilities.
tags: macOS - privacy - AI agents - cybersecurity - FortiMail