A security researcher has uncovered a macOS vulnerability that allows apps to bypass Privacy & Security settings. The Insent app demonstrates how macOS 13.5+ can grant persistent access to protected folders like Documents even when settings explicitly deny it. This occurs when apps access files through user intent mechanisms rather than direct requests.

The flaw works because macOS applies different sandboxing constraints based on how an app attempts to access protected folders. When users select a folder through an Open dialog, the system removes sandbox restrictions for that specific location, creating a gap between visible permissions and actual access. Once granted, this access persists regardless of Privacy settings toggles.

Resetting the compromised permissions requires an arcane Terminal command and system restart. While exploitation needs specific user interaction sequences, the permanence of unauthorized access raises concerns about user control over protected locations. Apple's TCC framework appears to have a fundamental disconnect between displayed security settings and actual enforcement mechanisms.