Which permissions does an AI need to control a Mac?

Usually Accessibility (to click and type) and Screen & System Audio Recording (to see the screen), both in System Settings › Privacy & Security.

Can I revoke the permissions later?

Yes. Turn the app off in each list under Privacy & Security, or remove it from the list.

Is it safe to let AI control my computer?

It can be reasonably safe with a trusted app, narrow access and approvals for important actions, but it is never risk-free, so start small and supervise.

Can websites trick an AI agent?

Yes, through prompt injection: hidden or visible instructions in content the agent reads. Approvals and keeping agents away from sensitive accounts limit the damage.

Does the AI see everything on my screen?

With Screen Recording it technically can. Good apps look only at the window they work in; check how yours behaves before granting it.

How to let AI use your Mac safely

The short answer

To let an AI agent use your Mac, you grant its app two macOS permissions in System Settings › Privacy & Security: Accessibility, which lets it control the Mac (click, type, read on-screen elements), and Screen & System Audio Recording, which lets it see what’s on screen. Do it safely by using an app you trust, limiting what each agent can reach, requiring approval for important actions, watching new tasks, keeping sensitive accounts out of reach, and turning the permissions off when you stop using it.

What does "AI using your Mac" mean?

It’s usually called computer use: an AI agent looks at a window (a screenshot, often plus the list of buttons and fields macOS exposes for accessibility), decides what to do, then clicks, types or scrolls, and looks again. It lets an agent work in apps that have no other way in, like a desktop accounting program, but it also means the agent can do anything you could do in those apps.

Which macOS permissions are involved?

Permission	Where	What it allows
Accessibility	System Settings › Privacy & Security › Accessibility	Controlling your Mac through accessibility features: clicking, typing, reading elements on screen
Screen & System Audio Recording	System Settings › Privacy & Security › Screen & System Audio Recording	Seeing and recording the screen (and, if allowed, audio)

Apple warns that an app with Accessibility access can also reach information like your contacts and calendar, that what it collects is governed by that app’s own terms, and to grant access only to apps you know and trust.

What can go wrong?

Ordinary mistakes. The agent clicks the wrong row, overwrites a cell or sends a half-finished message.

Misleading content. Text on a web page, in an email or inside an image can contain instructions. Anthropic’s computer-use documentation warns that its model may follow such instructions even when they conflict with yours, and recommends isolating agents from sensitive data and actions.

Too much reach. An agent signed into your bank, password manager or admin consoles can act there too.

An untrusted app. The permissions go to the app, not the AI. A careless app with Accessibility access is a risk whether or not an AI is involved.

A safety checklist

Choose the app carefully. Know who makes it, where your data goes and whether it runs on your computer or sends your screen elsewhere.
Start with low-stakes tasks in apps where a mistake is easy to undo.
Require approval for sending, paying, deleting, posting and changing settings. Anthropic recommends a human confirm decisions with real-world consequences, like financial transactions or accepting terms.
Watch the first runs. Confirm it does what you meant, then let it run more on its own.
Limit what it can reach. Keep it out of password managers, banking and admin tools; use a separate user account or test data where you can.
Know how to stop it. Find the stop or take-over control before you need it.
Review access now and then. In Privacy & Security, turn off apps you no longer use.

Should you use a virtual machine?

For developers experimenting with raw computer-use tools, Anthropic suggests a dedicated virtual machine or container with minimal privileges. That’s the safest setup but not practical for most people who want an agent to work in their real apps with their real files. The checklist above is the everyday middle ground: real apps, narrow access, approvals and supervision.

How AppuBot handles this

AppuBot runs on your own computer, and your bots, files and chats stay there. It asks for the two permissions once and shows their state in Settings › Permissions. Computer use is a per-bot switch, so only the bots that need it have it. On approvals ("Approve for me") a bot asks before anything important and waits however long you take. Bots work inside an app’s own window and mostly leave your mouse alone; a small pointer with the bot’s face shows each click, and you can take over at any time. In work in the background mode they wait for you to pause before anything that needs the screen. It also runs on Windows and Linux, where the permissions differ.

Sources

Facts about other products are from their makers’ pages as of 29 October 2026 and may have changed since. Product names are trademarks of their owners.