TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
An Eighth Rank report describes macOS services that assemble a local knowledge graph from data such as Contacts, Photos, Calendar, Messages and location signals. The researchers say the graph can represent relationships between people, but Apple’s public documentation offers little detail about its inputs or inferences. Their findings are based on macOS 26.6.2 and do not establish that every Mac model or earlier macOS release behaves identically.
Security researchers at Eighth Rank have published an analysis of a macOS knowledge graph that combines information from across a user’s device to represent people, events and relationships. Their examination of macOS 26.6.2 found local databases and system services that process sources including Contacts, Photos, Calendar, Messages and location data; the report says the graph can capture relationships among people, including family connections.
The report identifies two services, knowledgeconstructiond and intelligenceplatformd, as working together to build the graph. Apple’s macOS man page describes knowledgeconstructiond as a daemon that analyzes on-device content to build “a general purpose knowledge graph” representing the device and its user. Eighth Rank says the man page provides little detail about the system’s inputs or the specific relationships it infers.
Researchers found a directory at ~/Library/IntelligencePlatform containing 51 SQLite databases. The report describes these databases as plaintext and says the directory is protected by macOS’s Full Disk Access privacy controls. The central database, graph.db, uses 181 entity classes and 278 predicates to record connections among entities such as people, apps and events. Its records also contain confidence information, sources, duplicate-source counts and timestamps, according to the analysis.
The data sources identified include Contacts, Photos, Calendar, Family Sharing, Health, Mail and Messages, along with information supplied by apps through App Intents. The report also describes separate records for communications—who contacted whom, when, through which app and in which direction, but not message content—as well as location, movement and device signals. Eighth Rank says some communication records draw on other Apple devices. It also found a stream named ContextualUnderstanding.PhysicalSocial whose records include people’s names, phone numbers or email addresses and start and end times; the researchers say this format appears to log who was physically nearby, though that interpretation is not independently confirmed by Apple.
What the Graph Can Reveal
A store linking contacts, communications, locations and social relationships can reveal more than any one data source on its own. Even without message contents, a log of who communicated, when and through which app can describe patterns of contact. Combined with calendar events, photo associations and location records, the graph may provide a detailed account of a person’s routines and relationships.
The report’s findings matter to users because the graph appears to be an operating-system feature rather than a database they deliberately created. Its local storage and Full Disk Access protections are relevant safeguards, but they do not answer every question about what is inferred, how long information is retained or which system features query it. Eighth Rank argues that a consolidated personal store could become a privacy risk if accessed by someone who gains access to it. That is a risk scenario in the report, not evidence that the database has been breached or that a particular exploit has been used.
The family and relationship angle also calls for care: a database can encode a relationship without establishing that the inference is accurate. Eighth Rank’s description of the graph’s structure and data sources is based on its examination of one macOS release. The report does not establish how the system performs for every user or whether its inferred relationships are routinely shown to people or used to make consequential decisions.
Products Worth Considering
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Liquid Retina Display, and Touch ID – Midnight
Jackery Explorer 300 Portable Power Station, 292Wh
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Apple’s Sparse Public Description
Apple’s man page for knowledgeconstructiond says the service analyzes content on a device to help build a knowledge graph and works with intelligenceplatformd on heavy processing tasks. The report says Apple researchers published work on graph-construction techniques in 2023, but that publication does not, in Eighth Rank’s account, explain the full macOS integration or provide a complete inventory of collected and inferred information.
Eighth Rank says it examined the system while researching Apple Intelligence on macOS 26, using version 26.6.2 for the analysis. Its report follows earlier public work on the subject: it cites Nic Lydon’s account of finding a personal knowledge graph on a Mac and a September 2026 report by Alexis Brignoni on examining a similar store on iOS. Those reports provide related investigative context; they do not establish that every operating system version stores or processes data in precisely the same way.
Eighth Rank also released iKnow, a local dashboard intended to let users inspect the contents of their Mac’s personal knowledge graph. The source material describes the tool as open-source. Its release gives technically inclined users a way to examine the store, but the report does not say that Apple has adopted the tool or endorsed its interpretation of the records.
“A daemon that analyzes content on the device to build a general purpose knowledge graph.”
— Apple’s macOS man page for knowledgeconstructiond, as quoted in the Eighth Rank report
What Apple Has Not Detailed
Apple’s cited documentation does not specify the full data inventory, retention rules or inference methods, and the source material contains no response from Apple addressing Eighth Rank’s findings. It is not clear from the report how the graph changes across macOS versions, which users or devices have every described data source enabled, or how the system handles conflicting or inaccurate information.
The researchers’ analysis is specifically based on macOS 26.6.2. Their interpretation that the PhysicalSocial stream records nearby people is presented as an inference from the record format, not as a function Apple has confirmed. The report also describes the graph as a store that large language models can retrieve from “allegedly”; the supplied material does not establish which models, if any, access it, under what conditions, or what information they retrieve.
The existence of a local database does not by itself show that its contents are sent to Apple or another party. The provided findings describe on-device construction and local storage, but do not settle all questions about data flows, access by individual macOS features, or the practical accuracy of relationship labels.
Further Checks and Apple’s Response
Readers can use iKnow, the dashboard released by Eighth Rank, to inspect their own graph locally, according to the report. Its findings may also be checked against other macOS versions and compared with the iOS database examined in the separate forensic work cited by the researchers.
The next key development would be a more detailed explanation from Apple of which services use the graph, what information they add, how long records remain and whether users can control or remove particular inferences. Until such details are available, the report offers a technical account of one software version, while questions about broader behavior and Apple’s intended use remain open.
Key Questions
What did Eighth Rank find on Macs?
The researchers describe two macOS services that work together to build an on-device knowledge graph, stored in databases under ~/Library/IntelligencePlatform. Their analysis focused on macOS 26.6.2.
Does the graph include message contents?
The report says a communications log records who contacted whom, when, through which app and in which direction, but not message content. It separately identifies Messages as a source of some events and contacts; the supplied material does not explain every detail of how those sources are processed.
Does Apple confirm that the Mac identifies family members?
The cited Apple man page confirms that knowledgeconstructiond helps build a general-purpose knowledge graph. Eighth Rank reports family-related information and relationship modeling, but the supplied material does not include an Apple statement confirming the specific family-member classification described by the headline.
Is the graph sent to Apple?
The report describes the graph as built and stored on the device. The material provided does not establish that the graph itself is sent to Apple, nor does it answer every question about how other system features may access or use it.
Can Mac users inspect the graph?
Eighth Rank says it released iKnow, an open-source local dashboard for reading a Mac’s personal knowledge graph. The report does not say Apple has endorsed the tool.
Source: 8rank.ai
