TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A report by security research firm Eighth Rank describes macOS services that build an on-device knowledge graph from sources such as Contacts, Photos, Calendar and communication metadata. Its examination of macOS 26.6.2 found relationship and presence-related records, but Apple’s public documentation does not explain the full system or its inferences.
Eighth Rank identified two macOS services, knowledgeconstructiond and intelligenceplatformd, associated with building and processing a general-purpose knowledge graph. The macOS man page describes knowledgeconstructiond as analyzing content on a device to build “a general purpose knowledge graph” representing the device and its user. The report says the services’ data is kept in SQLite databases under the user’s IntelligencePlatform directory.
The researchers’ examination found 51 databases in that directory and describes graph.db as a triple store: records connect a subject, a predicate and an object. The report says its vocabulary includes 181 entity classes and 278 predicates. Examples of input sources include Contacts, Photos, Calendar, Family Sharing, Health’s Medical ID emergency contact, and people identified through Siri Suggestions in Mail and Messages.
Eighth Rank also describes companion records for communication metadata, including who communicated, when, through which app and in which direction, without message content in that log. Other tables, according to the report, contain location and movement information, co-occurrence in photos, and device signals. A stream named ContextualUnderstanding.PhysicalSocial contains records with people’s names and contact details alongside start and end times; the researchers say its format appears to record who was physically nearby, but that interpretation is theirs.
How the Graph Could Affect Privacy
A system that connects data across apps and device features can form a more detailed picture than any single record shows. Relationship links, communication patterns, location information and co-appearance in photos may together reveal associations and routines, even where message text is not included in a particular communications log.
The report’s findings matter to Mac users because the graph is described as stored locally and queryable, while its exact contents and purpose are not fully explained in Apple’s public documentation. Eighth Rank raises the risk that a concentrated personal data store could become a privacy weak point if accessed by someone unauthorized. That is a risk scenario presented by the researchers, not evidence in the supplied report that the database has been compromised or that a particular attack has occurred.
Popular right now
De'Longhi COM630BK All-in-One Coffee and Espresso Machine
Ninja Luxe Café Mini Espresso and Drip Coffee Machine, Stainless Steel, ES301
De'Longhi COM530M All-in-One Coffee and Espresso Machine, 47 oz
As an affiliate, we earn on qualifying purchases.
What Apple Documents About the Services
Apple’s man page for knowledgeconstructiond says the service analyzes on-device content to build a graph representing the device and user, and works with intelligenceplatformd on heavy processing. Eighth Rank says Apple researchers published a paper on graph-construction techniques in 2023, but argues that public materials provide little detail about how the system is integrated into macOS, which releases run it, or the full set of data and inferences involved.
The Eighth Rank analysis is based on macOS 26.6.2. The researchers say they encountered the system during security work on the Apple Intelligence bundle in August 2026. Their report also points to earlier independent work examining the Mac knowledge graph and a September 2026 forensic-tool analysis of a similar store on iOS. Those references provide context, but do not establish that the Mac and iPhone implementations are identical.
“A daemon that analyzes content on the device to build a general purpose knowledge graph.”
— Apple’s macOS man page for knowledgeconstructiond
What the Report Cannot Establish
The analysis is a researchers’ account of one macOS version, not a complete public specification of the feature across all Macs or operating-system releases. The source material does not establish exactly when the services first appeared, which Mac models or macOS versions contain them, or whether every listed data source is used in every user’s graph.
Apple’s documentation, as described in the report, does not explain the full set of inferences, how confidence values are assigned, how long records are retained, or which system features or models query the graph. The report says the databases are in plaintext within an area protected by Full Disk Access controls; it does not show that the files are accessible to ordinary apps without permission, nor that data has been sent to Apple or another party. The supplied material also does not independently confirm that the PhysicalSocial records always indicate physical proximity or that the graph specifically classifies family members.
What Users and Apple May Clarify
Eighth Rank says it has released iKnow, a local dashboard intended to let users inspect their personal knowledge graph. Readers considering the tool should review its documentation and permissions before use; the report does not establish that every record is easy to interpret or that the dashboard covers every database.
The next major clarification would come from more detailed Apple documentation addressing supported macOS versions, data sources, relationship inferences, retention and access controls. The source material does not cite an Apple response to Eighth Rank’s findings or announce a change to macOS. Until those details are available, the report provides a technical snapshot of one system version, rather than a definitive account of every Mac’s behavior.
Key Questions
What did Eighth Rank find on a Mac?
The researchers describe two services associated with building a personal knowledge graph and 51 SQLite databases in the IntelligencePlatform directory on the macOS 26.6.2 system they examined.
Does the graph include family relationships?
The report says the graph contains relationship records and lists Family Sharing data among its sources. The supplied findings do not establish exactly which family ties macOS infers or how consistently it does so.
Does the report say macOS reads message content?
Eighth Rank says a particular communication log records who communicated, when, through which app and in which direction, but not message content. That statement concerns the log described in the report and does not, by itself, establish that no other system component can process message content.
Is the database sent to Apple?
The report describes the graph as stored locally. The supplied material does not show that the database is transmitted to Apple or another party, and it does not provide a complete account of any related data flows.
Can users inspect their own graph?
Eighth Rank says it released iKnow, a local dashboard for viewing the graph. Users should check the tool’s documentation and requested access before running it; the report does not claim that it reveals every relevant record in an easily interpretable form.
Source: 8rank.ai
