TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
An Eighth Rank report describes macOS services that build a personal knowledge graph from data on a Mac, including contacts, photos, calendars and communication metadata. The researchers say the graph can represent relationships between people, but Apple’s public documentation does not explain the system’s full inputs or how it infers kinship.
Security researchers at Eighth Rank say macOS 26 maintains an on-device knowledge graph that draws on personal data and records relationships among people, events and organizations. Their report describes how the system combines information from sources including Contacts, Photos, Calendar, Mail and Messages, and examines its representation of family and other connections; Apple’s brief public description does not detail the full scope of the data or the relationship inferences.
Eighth Rank says two macOS services, knowledgeconstructiond and intelligenceplatformd, work together to construct the graph. The macOS man page describes knowledgeconstructiond as analyzing on-device content to build “a general purpose knowledge graph” representing the device and its user. The researchers examined the system on macOS 26.6.2.
The report describes a local directory containing SQLite databases, with graph.db as the main store. Eighth Rank says that database organizes information into entities and relationships, with records carrying confidence, source and timestamp fields. It also reports finding data drawn from Contacts, faces in Photos, Calendar details, Family Sharing, a Health Medical ID emergency contact, and people identified by Siri Suggestions in Mail and Messages.
Other associated tables reportedly hold communication metadata—such as who contacted whom, when, through which app and in which direction—along with location and movement information and device signals. Eighth Rank says the communication log does not contain message content. The report also identifies a record format that lists people by name, phone number or email with start and end times, which the authors interpret as appearing to track who was physically nearby. That interpretation is not confirmed by Apple in the supplied material.
A Detailed Map of Personal Connections
A graph that links identities, communications, events and locations can provide software with a structured account of a user’s life, rather than isolated pieces of information. That may help personalized features retrieve relevant context, but it also raises privacy and transparency questions about what the system derives and how users can inspect or control it.
The report’s family-related findings matter because relationship labels can expose sensitive details about a person and their household. Eighth Rank describes Family Sharing information and discusses kinship inference, but the source material does not establish how reliably the system makes those inferences or what products use them. The researchers’ description of a potential risk if such a database were accessed by the wrong party is a security scenario, not evidence that the graph has been breached.
Products Worth Considering
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Sky Blue
Kindle Paperwhite Kids (2024), 16 GB, 7-inch Display, Cyber City Cover
Apple iPad Air 11-inch (M4), 128GB, Wi-Fi 7, Space Gray
As an affiliate, we earn on qualifying purchases.
What Apple Documents About the Graph
Apple’s man page, as quoted by Eighth Rank, says the daemon analyzes on-device content to help build a knowledge graph and shares processing work with intelligenceplatformd. That confirms the stated purpose of the service, but offers little detail about which macOS versions run it, the data sources involved, or the kinds of relationships it records.
Eighth Rank places its analysis alongside earlier work. It notes that Apple researchers published a paper on graph-construction techniques in 2023, while saying that paper does not explain how the system is integrated into macOS or document the kinship inference examined in this report. The researchers also cite earlier independent investigations of the graph on Mac and iPhone. Their own findings are based on macOS 26.6.2, so they should not automatically be taken as a complete description of other operating-system versions.
“A daemon that analyzes content on the device to build a general purpose knowledge graph.”
— macOS man page for knowledgeconstructiond, quoted by Eighth Rank
How Relationship Inferences Work
The report does not establish exactly how Apple determines kinship, how accurate those inferences are, or whether every listed data source is used in every case. It is also unclear which Apple features query the graph, what information leaves the device, and what settings let users limit collection or remove entries. Eighth Rank describes the database files as plaintext within a directory protected by Full Disk Access controls; the supplied source does not document a vulnerability or unauthorized access.
The physical-proximity interpretation of the ContextualUnderstanding.PhysicalSocial records is the researchers’ reading of the record format, not an Apple-confirmed account of its purpose. The report’s discussion of possible misuse likewise outlines a hypothetical risk, not a reported incident.
Inspecting the Local Data Store
Eighth Rank says it has released iKnow, a local dashboard intended to let Mac users read their personal knowledge graph. The report does not state whether Apple plans to publish fuller documentation or change the system. Users seeking clarity will need more information from Apple about the graph’s inputs, relationship labels, retention and controls, while independent analysis can test how findings vary across macOS versions.
Key Questions
What did Eighth Rank find on Macs?
The researchers describe macOS services that build an on-device knowledge graph linking information about the user, people, events and organizations. Their analysis examined macOS 26.6.2.
Does the graph store message contents?
Eighth Rank says the communication log records metadata such as participants, time, app and direction, but not message content. The report separately says Siri Suggestions can identify people in Mail and Messages.
Does Apple confirm that Macs classify family members?
The man page Apple provides, as quoted in the report, confirms a daemon builds a general-purpose knowledge graph. It does not document kinship inference. The family-relationship discussion is based on Eighth Rank’s analysis, not a detailed Apple explanation.
Has the graph been breached?
The source material does not report a breach. Eighth Rank discusses the consequences of hypothetical access by an unauthorized party; that scenario should not be read as evidence of an incident.
Can Mac users inspect the graph?
Eighth Rank says it released a local dashboard called iKnow for viewing the graph. The report does not establish whether Apple provides a built-in viewer or describe a complete set of user controls for deleting or limiting the data.
Source: 8rank.ai
