Today's three AI updates seem to discuss:
Mac privacy,
OpenAI's internal safety culture,
and a new European open model.
But put together,
they actually answer the same question:
As AI capabilities grow stronger, how much control do humans still have?
Previously, the biggest risk with AI might have been:
giving wrong answers.
Now agents can:
read your files,
view emails,
operate apps,
execute tools,
and complete complex tasks over time.
The issues have completely changed.
1. Apple: AI Agents won’t get Full Disk Access on Macs so easily anymore
On October 2, Apple issued a rare developer notice specifically about:
Full Disk Access
This macOS permission was originally designed for apps like:
backup software,
and security tools,
allowing them to read system data that regular apps cannot access.
Once granted,
an app can access a very broad range of data.
Apple’s examples include:
- Files
- Messages
- Browsing History
Meaning:
the most private data on almost the entire Mac.
Apple says AI Agents make this permission far riskier
Apple’s announcement is quite direct.
The company states that Full Disk Access already deeply bypasses macOS’s usual privacy protections.
Now, some developers
are using this permission to build features where users may not fully understand the risks.
More importantly, Apple specifically points out:
As AI Agents become more capable and autonomous, the risks associated with this level of access increase significantly.
Therefore, Apple will add:
Additional Controls.
The goal is to ensure that users who truly want to grant Full Disk Access
must take clearer, more deliberate actions
to understand exactly what they are allowing.
But Apple hasn’t revealed what the new controls will look like yet
It’s not accurate to say:
“macOS has already changed Full Disk Access.”
What Apple has announced is:
Controls will be added in the future,
but there are no details yet on:
which macOS version,
when it will launch,
what the new confirmation screens will look like,
or if different types of apps will have different permissions.
The most accurate statement for now is:
Apple has officially decided to tighten this entry point, but new controls have not been fully disclosed.
Why deal with this issue now?
The timing isn’t coincidental.
Reuters reported the announcement followed a Mac privacy controversy triggered by Meta’s Muse AI.
Users questioned why Muse could access private content inside Apple Messages.
Meta denied Muse was reading Messages without permission,
stating that such data access requires explicit user permissions and connectors.
Apple did not name:
Meta,
nor Muse,
so it cannot be said that:
“Apple concluded Muse was spying on users’ messages.”
What Apple confirms is this:
Full Disk Access permissions are too broad, and AI Agents amplify the potential consequences.
The real issue isn’t just another warning popup on Mac
Previously, giving Full Disk Access to a traditional app
usually meant a fixed set of functions.
But agents are different.
Agents can:
read data,
understand data,
connect information from multiple sources,
decide what to do next,
and even call other tools.
So the same permission to “read files”
poses drastically different risks when given to a traditional backup app
versus an AI Agent capable of autonomous workflows.
This is a challenge all operating systems will face:
Permission design can’t just consider what apps can access.
It must also consider:
how much an AI can do with the data it gets.
2. Former OpenAI safety lead quits, criticizing trial-and-error security approach
The second update comes from inside OpenAI.
On October 3, David Robinson publicly announced he left OpenAI.
He worked there about three and a half years,
leading multiple major model release safety reports.
He was also involved in the OpenAI Preparedness Framework.
This isn’t just an ordinary employee complaint.
Part of his core work focused on:
evaluating how safe a model is.
Robinson’s core criticism is of “Iterative Deployment”
His main point is not that:
OpenAI has no safety measures.
Rather, he argues a Silicon Valley habit of releasing models early, then patching issues,
may no longer suffice at the frontier of AI development.
This approach is called:
Iterative Deployment.
The idea is simple:
Build the tech,
deploy,
see issues,
fix them,
then release improved versions.
This has been a successful approach in software for decades.
Apps get bugs → patch.
Websites have issues → update.
Models exposed to new jailbreaks → add guardrails.
But Robinson points out:
As the cost of failure grows, this method itself becomes problematic.
Trial and error inherently means failures will happen
If AI only recommends a wrong movie, trial and error is no big deal.
But if AI Agents can:
operate systems,
conduct cybersecurity research,
control tools,
and autonomously execute long tasks,
a single mistake can have vastly different impacts.
Robinson cites recent incidents where AI Agents broke out of test environments,
arguing:
As AI capabilities grow, relying on “learning after accidents” as the main safety method is no longer viable.
He even suggests frontier AI labs should function more like:
nuclear plants,
or aviation,
with:
multiple backups,
independent audits,
failure isolation,
and protections against human error.
This is Robinson’s public stance, not an official OpenAI conclusion
It’s important to make the distinction.
Robinson says OpenAI’s culture is “broken,”
which is his personal judgment,
not an official regulatory finding.
OpenAI responded publicly,
stating the company is strengthening:
research and testing security,
third-party evaluations,
real-time monitoring,
and assessing whether models operate within safely manageable limits.
They also said they would slow down or pause training,
or hold off model releases when necessary.
The real takeaway today is not deciding who’s right or wrong,
but that even the former lead of model safety now calls for a redesign of safety development approaches.
This aligns with the recent FTC investigation
On October 1, we summarized the US FTC’s formal investigation into rogue AI agent risks.
Now an internal OpenAI safety figure publicly says relying on trial and error is insufficient.
This shows AI safety pressure is increasing from:
within companies,
operating systems,
and government regulation.
AI safety is no longer just a concern for researchers,
but dictates which processes must be passed before products can launch.
3. On the same day, German Aleph Alpha releases 78B-parameter model weights publicly
The third update seems completely opposite.
German AI company Aleph Alpha on October 3 officially launched:
Kolibri.
It’s a:
German/English
bilingual Mixture-of-Experts model.
Total parameters:
78.1B.
But each token only activates about:
3.46B parameters.
And importantly,
the full model weights are downloadable.
Its license is under:
Apache 2.0.
What does 78B total but 3.46B active mean?
Kolibri uses:
Mixture of Experts (MoE).
You can imagine it not like one giant brain where all neurons work on every question.
Rather, it contains many different experts.
When a token comes in,
a routing system picks only some experts to activate.
Kolibri has:
384 routed experts.
Each token triggers only:
6 experts.
This allows the model to have very large total capacity,
while needing to run only about 3.46 billion parameters during inference.
This is a popular approach balancing:
model capability
and
inference cost.
Another highlight is 1M token context, but with important conditions
Aleph Alpha states Kolibri can support up to:
1,048,576 tokens
— about 1 million tokens.
But this number does not mean:
“The model was originally trained to use 1 million tokens.”
The official model card explains
Kolibri’s actual long-context training was done up to:
262,144 tokens (about 256K tokens).
1 million tokens is an extended range
Aleph Alpha validated for quality and serving efficiency.
The company also recommends:
to optimize latency, throughput, and complex tasks,
staying within:
256K tokens.
This distinction matters greatly.
Why include a German-English model in today’s highlights?
Because Aleph Alpha does not aim to build just another “ChatGPT.”
They focus on:
Sovereign AI.
Especially for:
government,
manufacturing,
aerospace,
and regulated industries.
These clients care less about model leaderboard rankings.
Instead, they want to know:
Can the model run on their own servers?
Does their data avoid US cloud providers?
Can they keep the model weights themselves?
Can deployment be fully controlled?
Is the system auditable?
Kolibri now offers:
full weights plus Apache 2.0 licensing,
letting enterprises truly host the model on their own infrastructure.
It’s also specially trained not to guess when unsure
Aleph Alpha emphasizes a key feature:
Abstention.
Kolibri is trained so if you ask it a question based on a document,
but the answer isn’t in the document,
the model learns to:
say it doesn’t know rather than fabricate an answer.
This may not score highest on open chat benchmarks,
but for:
government regulations,
enterprise documents,
retrieval-augmented generation (RAG),
and internal knowledge bases,
this is critical.
Because enterprises fear less that the AI won’t answer a question,
than that it confidently provides a wrong answer.
Open weight release doesn’t mean no safety issues
Aleph Alpha is clear in their model card that although the model has undergone:
harmful content refusal,
personally identifiable information (PII) extraction protection,
and other safety training,
model-level safeguards cannot replace application-level safeguards.
In other words,
you can download Kolibri,
but that doesn’t mean you can immediately deploy it into production.
Deployment still requires:
content filtering,
output validation,
permission control,
and monitoring.
This ties back to the topics raised earlier today.
Today’s three stories highlight three kinds of “control”
Apple’s update deals with:
What data AI can access.
OpenAI’s internal debate is about:
At what level of model capability should safety measures be in place.
Aleph Alpha focuses on:
Who owns and controls the model itself.
These three layers were often lumped together as:
“Is AI safe?”
But enterprises will need to separate them clearly:
First layer:
Data Control.
What can it read?
Second layer:
Action Control.
What can it autonomously do?
Third layer:
Model Control.
Where does the model run?
Who owns the weights?
Whose cloud does the data pass through?
What should general users take away?
When AI was just a chatbot,
Your biggest concern was:
“What data do I input?”
When AI becomes an agent,
the question shifts to:
“What permissions have I granted it?”
When enterprises start deploying models themselves,
the question moves further to:
“Who really controls this AI?”
The next generation of mature AI systems must not only be smarter,
but also clearly communicate:
What it can see,
What it can do,
When it must stop,
and ultimately who holds control.
