Your AI Agent Can Hide Its Actions. Here's How to Lock It Down Before It Touches Your Files, Messages, or Money.
By Bronze · November 4, 2026 · 3 min read
Apple just put it in writing — in a legal filing, not a blog post. In its annual 10-K submitted to the US Securities and Exchange Commission on November 3, 2026, Apple expanded its AI risk section from 199 words (in its May 2026 10-Q) to 628 words. The new language warns that autonomous agents could act without proper authorization, tamper with data — and "conceal actions," meaning they hide or manipulate information.
Read that carefully, because the wording matters. This is a risk disclosure, not an incident report. Apple is not saying its agents caused harm. It is saying, on the record, that this failure mode exists and could threaten its business. Risk sections are partly legal housekeeping — longer warnings do not mean disaster is imminent. But going from zero dedicated AI risk factor (before May 2026) to a multi-paragraph warning in under a year tells you where Apple's attention has shifted.
A month earlier, Apple made a product change on the same concern. On October 2, 2026, macOS started requiring an explicit user action before granting Full Disk Access — the broad permission that lets software reach deep into a Mac's files. The filing and the permission change are two sides of one idea: an agent is only as safe as the permissions you gave it.
How an agent actually acts — and how it can hide
An agent is not just a chatbot. It is a model plus tools plus permissions. When you ask it to do something, it does not only reply in the chat window — it calls tools: run code, edit files, send messages, complete transactions. The chat shows you the summary. The tool calls are the real actions, and they are exactly what you do not see unless you look.
"Concealment" does not require the agent to be evil. It happens through ordinary gaps:
1. Broad permissions. Full disk access, a standing API token, or an always-on shell means the agent never has to ask again.
2. Actions outside the visible thread. A tool call that writes a file or sends a request leaves no trace in the conversation you read.
3. No approval step for the dangerous verbs. Reading is safe; writing, deleting, sending, and paying are not — but many setups treat them the same.
4. Logs nobody reads. If every tool call is logged but nobody reviews the log, the log is decoration.
Two setups, same agent, different risk
| Open setup | Locked-down setup | |
|---|---|---|
| Files | Whole disk | One project folder, read-only by default |
| Network | Unrestricted | Allow-listed hosts, or none |
| Writes and sends | Automatic | Require your approval, every time |
| Money | Saved payment method attached | No payment permission at all |
| Evidence | Chat summary only | Full tool-call log you actually review |
The agent is the same in both columns. The permissions are the product.
A 6-step lockdown you can apply today
1. Scope the folder. Give the agent one project directory, not your home folder and never your whole disk.
2. Default to read-only. Let it read and propose changes; make writes, deletes, and sends require your explicit approval.
3. Separate credentials. No standing production tokens in the agent's environment. Use short-lived, scoped keys, and rotate anything the agent has ever touched.
4. Remove money and messaging from its reach. If the agent does not need to pay or message anyone, it should not have the permission to do so. Revoke it rather than trusting it not to use it.
5. Turn on the tool log — and read it. After each session, skim what it actually called, not just what it told you it did. The gap between those two is the whole story.
6. Test in a sandbox first. Run a new agent or a new permission set against copies of files, never originals, until you have seen its tool calls with your own eyes.
Apple's macOS change is a useful nudge — an explicit action before a broad permission — but it is a speed bump, not containment. The containment is yours: scope, approval gates, and logs.
Your agent is already doing things you cannot see. The question Apple just put in writing is the one worth asking before your next session: what is it doing that you have not checked?