TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report by Eighth Rank describes two macOS daemons that build a personal knowledge graph from data on a Mac, including contacts, photos, calendars, communications and location signals. The researchers examined macOS 26.6.2 and released a local dashboard to inspect the graph, but the precise system behavior and its use by Apple Intelligence remain unclear.
Security researchers at Eighth Rank have published an analysis of a personal knowledge graph built on Mac computers, describing how macOS 26 gathers and links information about users, their contacts and their activities. The report says the graph is stored in local databases and draws on sources including Contacts, Photos, Calendar, Messages, Mail and location data, while noting that Apple’s public documentation provides little detail about the system’s operation.
The analysis focuses on two macOS services, knowledgeconstructiond and intelligenceplatformd. Eighth Rank cites the operating system’s man page, which describes knowledgeconstructiond as a daemon that analyzes on-device content to help build “a general purpose knowledge graph” representing the device and its user. The man page says it works with intelligenceplatformd, which performs some of the processing.
On a Mac running macOS 26.6.2, the researchers found 51 SQLite databases in the user’s ~/Library/IntelligencePlatform directory. They describe graph.db as a triple store: records connect a subject, a predicate and an object, allowing the system to represent entities and relationships. According to the report, entries include confidence, source information and timestamps. The databases are stored in plaintext, the researchers say, in an area protected by macOS’s Full Disk Access privacy controls.
The report lists information it says can feed the graph or related databases: Contacts; faces and co-appearances in Photos; Calendar titles and attendees; Family Sharing membership; a Health Medical ID emergency contact; suggestions drawn from Mail and Messages; and information supplied by apps. Separate tables reportedly track communication metadata, such as who communicated, when, through which app and in which direction, as well as location, movement and device signals. Eighth Rank says the communication log records metadata rather than message contents. It has also released iKnow, a local dashboard intended to let users inspect their own knowledge graph.
What the Mac Graph Can Reveal
A system that links details from separate applications can create a more revealing picture than any one item of data alone. The report describes a graph that can connect people, relationships, places and events, including inferred links among the user’s family, friends and colleagues. That makes the system relevant to privacy even if individual source records are already present in apps on the same computer.
Eighth Rank also raises a security concern: a consolidated personal profile could create a single point of exposure if someone gained access to it. The researchers frame this as a broader risk for personalized assistants and machine-learning systems, not as evidence that the Mac graph has been breached or misused. Their findings document local data structures and possible implications; they do not establish that an attacker has accessed the information.
Products Worth Considering
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Sky Blue
Apple iPad 11-inch with A16 Chip, 512GB, Wi-Fi 6, and Apple Pencil (USB-C) — Blue
DJI Osmo Pocket 3 Creator Combo 4K Vlogging Camera
As an affiliate, we earn on qualifying purchases.
Apple’s Sparse Public Documentation
The report says Apple’s most direct public description is the knowledgeconstructiond man page, which gives a brief account of the service but does not enumerate the data sources or explain how the graph is integrated across macOS. Eighth Rank points to Apple researchers’ 2023 paper on graph-construction techniques, while saying the paper does not explain the system’s precise implementation in macOS.
The authors say other researchers had previously examined related stores: Nic Lydon wrote about finding a personal knowledge graph on a Mac, and forensic researcher Alexis Brignoni documented a way to read a similar store on iOS. Eighth Rank’s own examination concerns macOS 26.6.2; its findings should not automatically be treated as a complete account of other macOS versions or Apple devices.
“A daemon that analyzes content on the device to build a general purpose knowledge graph.”
— macOS man page for knowledgeconstructiond, quoted by Eighth Rank
What Apple Has Not Explained
The report does not establish which macOS versions include every component, whether all listed sources are active on every Mac, or how often each database is updated. Apple’s brief service description does not confirm the full inventory of inputs reported by Eighth Rank. The authors’ observations apply to their examination of macOS 26.6.2 and should be understood as their findings, not a complete Apple specification.
It is also unclear from the material provided how Apple Intelligence or other system features query this graph, what controls users have over individual data sources, and how long records are retained. Eighth Rank says the graph is available to language models for retrieval “allegedly,” but the report material does not establish which models access it, under what conditions, or whether the graph is used for particular responses. No breach or external transmission of the databases is reported.
Inspecting the Local Databases
Eighth Rank’s released iKnow dashboard offers a way to inspect the personal knowledge graph on a Mac, according to the researchers. Readers considering it should consult the project’s own instructions and permissions before use; the report’s release is not an Apple endorsement. The authors also describe a security thought experiment about what could happen if a personalized knowledge base fell into the wrong hands, rather than reporting a known incident.
Further clarity depends on additional technical testing and a fuller account from Apple. Useful follow-up questions include whether the same data sources and structures appear across macOS releases, how users can limit collection, and how the graph is used by system features. Until those details are available, the report provides a window into one examined version of macOS, not a definitive description of every Mac.
Key Questions
What is the Mac knowledge graph?
It is a set of linked records that, according to Eighth Rank’s analysis, represents entities such as people, events and apps, along with relationships among them. The researchers found the graph in local databases associated with macOS’s IntelligencePlatform services.
What kinds of information does the report say it uses?
Eighth Rank lists sources including Contacts, Photos, Calendar, Family Sharing, Health, Mail, Messages, location and device signals. The report’s findings come from an examination of macOS 26.6.2; the list has not been confirmed as a universal inventory by Apple.
Does the graph store message contents?
The report says a communication log records metadata such as participants, time, app and direction, not message content. It does not establish that every database or service has identical behavior across all systems.
Can users view the graph?
Eighth Rank released iKnow, a local dashboard designed to inspect a user’s graph. The article does not describe it as an Apple tool, and users should review the project’s instructions and required permissions before running it.
Has the report found a security breach?
No. Eighth Rank discusses the possible consequences if a consolidated personal database were accessed by an attacker, but it does not report a known breach of the Mac knowledge graph.
Source: 8rank.ai
