TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
An Eighth Rank analysis of macOS 26 describes Apple daemons that build an on-device knowledge graph from sources such as Contacts, Photos, calendars and communication metadata. The report says the graph includes inferred relationships, but Apple’s public documentation offers only a brief description, and the analysis does not establish the full scope of collection across Mac versions.
An analysis of macOS 26.6.2 by security research group Eighth Rank describes two Apple background processes that build an on-device knowledge graph from personal information, including data about people and their relationships. The report says the graph can draw on sources such as Contacts, Photos, Calendar, Mail and Messages, while Apple’s public documentation provides only a short account of the system’s purpose.
Eighth Rank identifies the processes as knowledgeconstructiond and intelligenceplatformd. Apple’s macOS manual says knowledgeconstructiond analyzes content on the device to help build a general-purpose graph representing the device and its user, and works with intelligenceplatformd on processing. The researchers say they examined the system on macOS 26.6.2; their findings should not be treated as a complete account of every Mac or macOS release.
The report describes a collection of SQLite databases in ~/Library/IntelligencePlatform, including graph.db. Eighth Rank says that database represents information as linked entities and relationships, with records carrying details such as confidence, sources and timestamps. Its analysis lists inputs including contacts, photo face information, calendar titles and attendees, Family Sharing, Health emergency contacts, Siri Suggestions from Mail and Messages, and information supplied by apps.
The researchers also describe separate tables containing communication metadata—such as who contacted whom, when, through which app and in which direction—as well as location and movement records and other device signals. They say the communication log does not contain message content. The report highlights relationship inferences, including family or other connections, but does not establish that every listed source contributes for every user or under all settings.
Personal Data Becomes a Connected Map
A knowledge graph can make scattered information more useful to software by linking a person to events, places, communications and other people. That may support personalized features, but it also means the resulting record can reveal patterns that are less obvious when each source is viewed separately. The report’s account of relationship and interaction data makes the graph relevant to users concerned about how personal information is organized on their devices.
Eighth Rank characterizes the databases as stored in plaintext within a location protected by Full Disk Access controls. That description is not the same as a finding that the information is exposed to ordinary apps or remotely accessible. Still, a consolidated store could carry heightened consequences if an attacker or unauthorized user gained access to it. The report discusses that risk as a scenario, not as evidence of a breach or exploitation.
Products Worth Considering
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Sky Blue
Apple iPad Air 11-inch (M4), 128GB, Wi-Fi 7, Space Gray
Logitech MX Creative Console with 9 Customizable Keys, Graphite
As an affiliate, we earn on qualifying purchases.
A Sparse Official Description
Apple’s manual page, quoted by Eighth Rank, describes knowledgeconstructiond as analyzing on-device content to build a general-purpose knowledge graph. The report says Apple researchers published work on graph-construction techniques in 2023, but argues that public materials do not spell out how the system is integrated into macOS, which versions run it, or the exact information it collects and infers.
The Eighth Rank analysis follows earlier public examinations of similar data stores. It cites Nic Lydon’s account of finding a personal knowledge graph on a laptop and a September 2026 report by forensic researcher Alexis Brignoni, who adapted iLEAPP to read related stores on iOS. Those reports provide additional examples of researchers inspecting the databases; they do not, by themselves, confirm that the same collection and behavior apply identically across Apple devices or software versions.
““A daemon that analyzes content on the device to build a general purpose knowledge graph.””
— Apple’s macOS manual page for knowledgeconstructiond, as quoted by Eighth Rank
Collection Scope Remains Unspecified
The analysis is based on one stated environment, macOS 26.6.2, and does not establish precisely which macOS versions contain the same components or whether they collect the same categories of information. Eighth Rank says documentation does not provide a full inventory of sources or explain the reported family-relationship inferences. The report also does not show how often each data source is used, how long records are retained, or what user settings affect the graph.
The researchers describe the database as an on-device store and discuss possible misuse if it fell into the wrong hands. They do not report a confirmed compromise, nor do the supplied findings establish that a language model routinely queries the graph. The report frames that connection as alleged; its exact role in Apple Intelligence features remains unverified in the material provided.
Further Testing and Apple Clarification
Eighth Rank says it released iKnow, a local dashboard intended to let Mac users inspect their personal knowledge graph. Readers should treat the tool and the report as independent research, rather than as an Apple-issued explanation of the system. The source material does not give a date for a response from Apple or describe a planned company disclosure.
Further reporting would need to establish how the graph behaves across macOS versions and user settings, which sources feed it in practice, and how its records are used by Apple Intelligence or other features. Until Apple provides more detailed documentation or researchers publish testing across a wider range of devices, the full collection scope and retention rules remain open questions.
Key Questions
What is the Mac knowledge graph?
It is a set of linked records that, according to Eighth Rank’s analysis, represents people, events, organizations and relationships using information on the device.
What kinds of information does the report say may feed it?
The report lists sources including Contacts, Photos, Calendar, Family Sharing, Health emergency contacts, suggestions from Mail and Messages, app-provided information, communication metadata and location-related records. It does not establish that every source is used for every user.
Does the report say Apple reads message content?
Eighth Rank says its described communication log records metadata such as participants, time, app and direction, and does not contain message content. The report separately lists suggestions derived from Mail and Messages as graph inputs.
Is the graph known to be exposed or compromised?
No confirmed breach is described in the source material. Eighth Rank discusses the consequences of unauthorized access as a risk scenario, not as a reported incident.
Can Mac users inspect the graph?
Eighth Rank says it released a local dashboard called iKnow for inspecting the data. The source material does not provide enough detail to assess its compatibility or safety for every system.
Source: 8rank.ai
