TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
An Eighth Rank report describes macOS 26 services that assemble an on-device knowledge graph from sources including Contacts, Photos, Calendar and communication metadata. The report says the graph includes relationship inferences, but Apple’s public documentation provides only a brief description of the system; its full data flows and kinship logic remain unclear.
A report by security research group Eighth Rank describes two macOS services that build an on-device knowledge graph from information about a Mac’s owner and their contacts, including data the researchers say can support family-relationship inferences. The analysis is based on macOS 26.6.2 and highlights a gap between the system’s broad data sources and the limited public explanation Apple provides.
Eighth Rank identifies the services as knowledgeconstructiond and intelligenceplatformd. Apple’s macOS man page describes knowledgeconstructiond as analyzing on-device content to build “a general purpose knowledge graph” representing the device and its user, and says it works with intelligenceplatformd on processing. That confirms the graph-building function, but the man page does not list all data sources or explain how relationships are inferred.
According to the report, the services store data in a directory named ~/Library/IntelligencePlatform, containing 51 SQLite databases. The researchers say the main database, graph.db, represents information as linked entities and relationships, with 181 entity classes and 278 predicates. They report that records can carry confidence values, source information and timestamps. The report describes the databases as plaintext and says the directory is protected by macOS Full Disk Access controls.
Eighth Rank says the graph draws on sources such as Contacts, Photos, Calendar, Family Sharing, Health, Mail and Messages, as well as app-provided data and installed applications. It also describes separate tables containing communication metadata, location and movement information, and device signals. The researchers say the communication records track who contacted whom, when, through which app and in which direction, rather than message content. These descriptions are the researchers’ findings; the supplied material does not include an Apple response or independent verification of each data flow.
What the Graph Could Reveal
A knowledge graph can make scattered information easier for system features to retrieve and connect. But the report’s account suggests it may also assemble a detailed picture of a person’s relationships, routines and social contacts from data created for different purposes. That matters to users because a contact entry, a photo appearance and a calendar event may each disclose limited information on their own, while linked records could support broader inferences.
The report’s description of family-related information is especially relevant: it says Family Sharing data includes members’ ages and that the graph contains relationship categories. It also points to a stream called ContextualUnderstanding.PhysicalSocial, whose record format lists people by name, phone number and email with start and end times. Eighth Rank says this looks like a record of people physically near the user, but the supplied material does not establish exactly how those records are generated or what conclusions the system draws from them.
The analysis also raises a security question about the concentration of personal information. Eighth Rank frames a copied or exposed knowledge base as a potential privacy risk and discusses a hypothetical misuse scenario. That is a risk analysis, not evidence that the graph has been breached or that someone has used it to target a person. The practical takeaway is that users and security reviewers may want clearer documentation of what is collected, how long it is retained, and which system features can query it.
Products Worth Considering
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Liquid Retina Display, and Touch ID – Midnight
Kindle Paperwhite Signature Edition 32GB (2024) – Auto-adjusting front light, wireless charging, weeks of battery life – Metallic Black
Apple Watch Ultra 2 GPS + Cellular, 49mm Natural Titanium Case with Natural Titanium Milanese Loop, Large
As an affiliate, we earn on qualifying purchases.
A Brief Public Description
Apple’s man page, cited in the report for macOS 26.6.2, is the closest official description Eighth Rank identifies. It says the service analyzes content on the device and works with intelligenceplatformd to generate a knowledge graph. The report says Apple researchers published a paper in 2023 about graph-construction techniques, but that paper does not, according to Eighth Rank, explain how the system is integrated into macOS or provide a full inventory of its inputs.
The report places its findings alongside earlier investigations. It says Nic Lydon had previously written about finding a personal knowledge graph on a Mac, and that forensic researcher Alexis Brignoni later described reading a comparable store on iOS. Eighth Rank says its own analysis examined macOS 26 and that it released a local dashboard called iKnow for viewing a Mac’s graph. The supplied source does not provide enough detail to assess the tool’s security, compatibility or independent testing.
“A daemon that analyzes content on the device to build a general purpose knowledge graph.”
— Apple macOS man page for knowledgeconstructiond, as quoted by Eighth Rank
What Apple Has Not Explained
The supplied material does not establish which earlier macOS versions run these services, whether the same data sources are active on every Mac, or whether behavior varies with settings, apps or user permissions. Eighth Rank says its detailed analysis covers macOS 26.6.2; its claim that every Mac since 2022 ships the daemons is not independently confirmed in the material provided.
It is also unclear how the system derives kinship or other personal relationships, how accurate those inferences are, how users can review or correct them, and how long specific records remain stored. The report does not provide an Apple statement on the findings. Nor does the supplied material establish that the graph is accessed by a particular large language model, despite the report’s reference to retrieval by LLMs as an allegation. No breach or misuse is reported here.
Questions for Apple and Users
The next step for assessing the report is clearer documentation from Apple about the graph’s supported macOS versions, data sources, permissions, retention and use by system features. Apple could also clarify whether family or other relationship inferences are created, how confidence is handled, and what controls users have to inspect or remove those records. The supplied source does not say that Apple has announced such documentation or changes.
For now, Eighth Rank says its iKnow dashboard can display a local knowledge graph, while noting the data directory is subject to Full Disk Access protections. Users should treat the researchers’ account as an analysis of a particular macOS release, not proof that every listed record exists on every device. Further independent testing and any response from Apple would help establish how broadly the findings apply.
Key Questions
What is the Mac knowledge graph?
It is a database of linked entities and relationships that Apple’s man page says is built by knowledgeconstructiond with help from intelligenceplatformd. Eighth Rank says its analysis found personal, social and device information represented in the graph.
Does the report confirm that Macs infer family relationships?
Eighth Rank reports relationship categories and data sources it says can support family-related inferences. Apple’s cited man page does not describe kinship inference, and the supplied material does not independently confirm its methods or accuracy.
What information does Eighth Rank say is included?
The report lists sources including Contacts, Photos, Calendar, Family Sharing, Health, Mail and Messages, along with communication metadata, location and device signals. The exact records on an individual Mac may vary, and Apple has not published a full inventory in the material cited.
Has the knowledge graph been breached?
The supplied report discusses a hypothetical privacy risk if a personal knowledge base reaches the wrong hands. It does not report a breach or evidence of misuse.
Can users inspect their graph?
Eighth Rank says it released a local dashboard called iKnow for viewing graph contents. The source material does not provide enough information to evaluate its security or explain its compatibility beyond the researchers’ stated use.
Source: 8rank.ai
