TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report by Eighth Rank says macOS 26.6.2 builds a local knowledge graph from information and activity across the Mac, including contacts, photos, calendars and communication metadata. Apple’s brief man-page description confirms that macOS has a daemon for building a general-purpose graph, but the report’s detailed account has not been independently verified here.
A report from Eighth Rank says Macs running macOS 26.6.2 build an on-device knowledge graph connecting information about the computer’s owner, their contacts and their activity. The analysis describes a largely undocumented system that draws on data such as Contacts, Photos, Calendar, Mail and Messages, raising questions about what is inferred, how users can inspect it and how the stored information is protected.
Eighth Rank identifies two macOS background processes, knowledgeconstructiond and intelligenceplatformd, as working together to create and process the graph. Apple’s macOS man page for knowledgeconstructiond describes it as a daemon that analyzes on-device content to build “a general purpose knowledge graph” representing the device and user. That confirms the daemon’s stated role, but the short description does not enumerate every source or inference described by the report.
The researchers say the data is kept in SQLite databases under ~/Library/IntelligencePlatform. They report finding 51 databases, with graph.db holding entries represented as relationships between entities and values. According to Eighth Rank, the graph’s vocabulary includes 181 entity classes and 278 predicates. The report says entries also carry confidence, source and timestamp information.
The analysis lists Contacts, faces identified in Photos, Calendar titles and attendees, Family Sharing, Health’s Medical ID emergency contact, and people suggested from Mail and Messages among the graph’s inputs. Separate tables reportedly contain co-appearance in photos, communication metadata, location and movement, and device signals. The report says the communication log records who communicated, when, through which app and in which direction, but not message content. It also says the directory is stored in plaintext and sits behind macOS’s Full Disk Access protections; those details are findings attributed to Eighth Rank, not an independent audit.
A Map of Personal Relationships
A system that links people, places and routines can reveal more than any one entry in a contact list or calendar. Even without message text, communication timing and direction, photo co-appearances, location records and inferred relationships could combine into a detailed account of a person’s social and daily life.
That makes the report relevant to Mac users assessing privacy and to security professionals considering the consequences of a device compromise. Eighth Rank argues that a consolidated personal graph could become a high-value store of sensitive information if accessed by someone else. This is a risk analysis, not evidence that the graph has been accessed or misused.
The findings also distinguish on-device processing from the question of user visibility. Local storage may limit where data is processed, but it does not by itself explain what the system infers, how long it retains information, or which apps and features can query it. Those details matter for users deciding what personal data to provide to Apple services and third-party apps.
Popular right now
De'Longhi COM630BK All-in-One Coffee and Espresso Machine
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer with Pouring Shield, Cherry Tomato
Roborock Q7 M5+ Robot Vacuum and Mop with Self-Emptying Dock
As an affiliate, we earn on qualifying purchases.
Apple’s Sparse Documentation
The supplied report says Apple researchers published work on knowledge-graph construction techniques in 2023, while noting that the research did not explain in detail how the system is integrated into macOS. Its closest cited official description is the knowledgeconstructiond man page, which gives a broad purpose rather than a full inventory of data sources, versions or controls.
Eighth Rank says its examination was conducted on macOS 26.6.2. The report also points to earlier independent investigations: Nic Lydon wrote about finding a personal knowledge graph on a laptop, and forensic researcher Alexis Brignoni described examining a related store on iOS. The supplied material does not provide publication dates for the Eighth Rank report, so its timing beyond the operating-system version examined is unclear.
Eighth Rank says it released iKnow, a local dashboard intended to let users read their graph on a Mac. Its account also includes a hypothetical discussion of how a personalized knowledge base might be abused if it fell into the wrong hands. That scenario is framed as a broader security thought experiment, not as a reported incident involving Apple’s system.
“A daemon that analyzes content on the device to build a general purpose knowledge graph.”
— Apple’s macOS man page for knowledgeconstructiond, as quoted by Eighth Rank
What the Report Cannot Establish
The supplied material does not establish which macOS versions contain the same system, whether all listed data sources are active for every user, or how frequently the graph is updated. It also does not give a complete account of retention, deletion, user-facing controls, or whether and how Apple Intelligence or other models query the store; the report describes model retrieval as alleged rather than confirmed.
The database details and data-source inventory are findings reported by Eighth Rank and have not been independently verified in the source material provided. Apple’s quoted man page confirms the daemon’s general purpose, not every specific behavior. No evidence is supplied of unauthorized access, data exfiltration or harm to users.
Inspecting the Graph on Mac
Eighth Rank says users can use its iKnow dashboard to inspect the local knowledge graph. Readers should treat the report’s description as a starting point rather than a substitute for Apple documentation or an independent security review. Any tool that reads personal databases can itself expose sensitive information, so users should review its source and permissions before running it.
The next developments to watch are whether Apple publishes fuller documentation, clarifies which macOS releases and features use the graph, and explains available controls for reviewing or removing stored information. The supplied report does not describe an Apple response or announce a scheduled update, so no company action or timetable is confirmed.
Key Questions
What is the Mac knowledge graph?
It is a structured database that, according to Eighth Rank, links entities such as the Mac’s owner, other people, events and organizations through recorded or inferred relationships. Apple’s man page describes the daemon as building a general-purpose knowledge graph, but does not give the same level of detail.
What kinds of information does the report say it uses?
Eighth Rank lists sources including Contacts, Photos, Calendar, Family Sharing, Health’s Medical ID emergency contact, and people suggested from Mail and Messages. It also reports separate tables for communication metadata, location and movement, photo co-appearances and device signals.
Does it store message content?
Eighth Rank says the communication log records who communicated, when, through which app and in which direction, but not message content. The supplied material does not independently verify that description or establish how every other data source is handled.
Can users view the graph?
Eighth Rank says it released a local dashboard called iKnow for reading the graph on a Mac. Users should check the tool’s provenance and permissions before granting it access to personal data.
Has the graph been used in a data breach?
The source material reports no breach or unauthorized access. Eighth Rank discusses possible misuse as a hypothetical security risk, not as a confirmed incident.
Source: 8rank.ai
