TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
An Eighth Rank report describes macOS services that build a local knowledge graph from information and activity across a Mac. Its analysis says the graph includes relationship inferences, but Apple’s public documentation gives little detail about its inputs or how those inferences work.
Eighth Rank says macOS 26 builds a personal knowledge graph from data and activity on a Mac, including records that can connect a user to other people and characterize their relationships. Its analysis of macOS 26.6.2 describes on-device databases and services that Apple’s brief public documentation does not fully explain, raising questions about what is inferred and how users can inspect it.
The report centers on two macOS processes, knowledgeconstructiond and intelligenceplatformd, and databases kept under ~/Library/IntelligencePlatform. Eighth Rank says the directory contains 51 SQLite databases, including graph.db, a structured store of entities and relationships. The researchers describe its format as a subject, predicate and object, with records carrying confidence, source and timestamp information.
According to the analysis, information feeding the graph can include Contacts, Photos, Calendar, Family Sharing, Health Medical ID, and suggestions from Mail and Messages. The report also describes separate records for communication metadata, location and movement, and device signals. It says the communication log records who communicated, when, through which app and in which direction, but not message content. Some activity information may also be drawn from a user’s other devices.
Eighth Rank says the data is stored in plaintext within a directory protected by Transparency, Consent, and Control (TCC) Full Disk Access. That describes the researchers’ findings about the local store; it does not establish that the information is publicly accessible or that it is routinely sent off the Mac. The report also introduces iKnow, an open-source local dashboard intended to let users inspect the graph.
A Detailed Map of Personal Connections
A graph that combines contacts, communications, location and shared events can reveal more than any one source alone. If the report’s interpretation is accurate, linking those records may allow the system to represent connections among people and make relationship information available to software that queries the store. That could matter to users evaluating the privacy implications of on-device personalization.
The analysis also highlights a gap between what the operating system appears to do and what users can readily learn from Apple’s documentation. A local store is not the same as remote disclosure, and the report does not show that the data has been accessed by an attacker. Still, detailed records concentrated in one place can create a privacy and security concern if an unauthorized party gains access to the device or its protected data.
The report’s more alarming discussion of misuse is a thought experiment, not evidence of a breach or a demonstrated attack. Its practical contribution is to describe what the researchers found and to offer an inspection tool, rather than establish that the graph has caused harm.
Products Worth Considering
Kindle Paperwhite 16GB (2024) – 7 Glare-Free Display, Weeks Battery Life – Black
Jackery Solar Generator 1000 V2 with 200W Solar Panel, 1070Wh
Sonos Era 100 Wireless Smart Speaker, Black
As an affiliate, we earn on qualifying purchases.
What Researchers Found on macOS
Apple’s man page for knowledgeconstructiond describes it as a daemon that analyzes on-device content to build a general-purpose knowledge graph representing the device and user. It says the process works with intelligenceplatformd on heavier processing tasks. That public description confirms the graph-building role, but does not provide a complete inventory of inputs or explain how the system derives particular relationships.
Eighth Rank says Apple researchers published work on graph-construction techniques in 2023, while detailed information about how the system is integrated into macOS remains limited. The report also places its findings alongside earlier independent examinations: Nic Lydon wrote about a personal knowledge graph on a Mac, and in September 2026 Alexis Brignoni described adding support to the iLEAPP forensics tool to read a similar store on iOS. Those accounts are separate investigations and do not independently confirm every detail in the Eighth Rank analysis.
The report’s technical examination was conducted on macOS 26.6.2. Its claims should be read as findings about the version examined, not as a complete account of every Mac release or every user’s data. The supplied material does not establish that all listed data sources are active for every person or configuration.
“A daemon that analyzes content on the device to build a general purpose knowledge graph.”
— macOS man page for knowledgeconstructiond, as quoted by Eighth Rank
Limits of the macOS Findings
Apple has not provided a detailed public inventory in the material supplied here of which data is collected, how each source is used, or how relationship and kinship inferences are produced. Eighth Rank’s examination concerns one macOS version, and the report does not show that every Mac or account has the same records populated. It is also not clear from the supplied account which settings or permissions govern each individual data source.
The report describes databases in a TCC-protected location and outlines a scenario in which such information could be misused. It does not document a compromise, show that the graph is transmitted to a remote party, or establish that a language model actually retrieves every kind of information described. The claim that the store is used by language models is presented by the report as alleged, not demonstrated in the supplied material. Apple’s response, if any, is not included.
Inspecting the Graph and Seeking Answers
Eighth Rank says it has released iKnow, a local dashboard for viewing a personal knowledge graph on a Mac. Users interested in the report can consult its analysis and tool, while treating the findings as specific to the system and version examined. The supplied material does not provide details on the tool’s supported versions or independently verify its results.
The next key development would be a fuller explanation from Apple of the graph’s data sources, controls, retention and use by other software. Further examination across macOS releases and user configurations could clarify how widespread particular records and inferences are. Until then, the exact scope of collection and the practical role of the graph remain open questions.
Key Questions
What did Eighth Rank find?
The report describes macOS services and local databases that it says build a personal knowledge graph from information and activity on a Mac, including connections between people.
Does the report show that message contents are stored in the graph?
No. Eighth Rank says its communication log records metadata such as participants, time, app and direction, but not message content. The report separately says Mail and Messages can provide contacts or suggestions; the supplied material does not establish that message bodies are stored in the graph.
Is the graph sent to Apple or another remote service?
The supplied report describes databases stored locally on the Mac. It does not establish that the graph is routinely transmitted to Apple or another remote party.
Which Macs are covered by the findings?
The detailed analysis is based on macOS 26.6.2. The supplied material does not establish that every Mac model, release or user configuration contains the same populated records.
Has Apple explained how users can control this data?
The cited macOS man page briefly describes the graph-building service, but the report says public documentation does not explain the full set of inputs or relationship inferences. Apple’s response and a complete list of user controls are not included in the supplied material.
Source: 8rank.ai
