Every Mac comes with an (undocumented) family member classifier

Apple quietly embedded an undocumented background system across modern Mac operating systems that reconstructs a detailed personal knowledge graph of users and their social circles, according to research documented in 8rank.ai's report. Discovered during security research into the Apple Intelligence bundle on macOS 26, the architecture relies on two background daemons that ingest personal data across native applications to map familial, professional, and behavioral connections.

This analysis examines how Apple structures the underlying SQLite triple stores, what information the classification daemons index, and how local large language models query the resulting graph. The breakdown is intended for Mac administrators, security analysts, and privacy-focused engineers who need an exact accounting of what these processes write to disk without public documentation.

Every Mac comes with an (undocumented) family: what actually changed

Apple introduced a persistent graph-building subsystem in macOS 13 in 2022 that quietly links contacts, behavior, and hardware states on both Intel and Apple silicon hardware. Rather than relying on static application boundaries, the operating system executes a pair of background daemons named knowledgeconstructiond and intelligenceplatformd. Official platform descriptions offer minimal visibility into this process, with man page documentation for knowledgeconstructiond describing it only as a daemon that analyzes on-device content to generate a general-purpose knowledge graph representing the user and device.

The subsystem consolidates information inside fifty-one SQLite databases located in a protected local user directory at ~/Library/IntelligencePlatform. Security researchers observed the active implementation on macOS 26, specifically build 25G83 running macOS 26.6.2. The core database, graph.db, functions as an indexed triple store structured around a formal schema of 181 entity classes and 278 predicates. Every recorded entry contains a subject, a predicate, and an object, tracking identities, confidence scores, timestamps, and deduplicated system sources.

Every Mac comes with an (undocumented) family: how it works

The knowledge graph populates its edges by pulling inputs from Contacts, Calendar, Photos face-clustering models, Family Sharing records, and Health app Medical ID emergency listings. Background collectors ingest messages and emails identified through Siri Suggestions, application donations registered via App Intents, and installed software inventories. Beyond explicit contact metadata, the database registers who appears with whom in photo libraries, directional communication metadata across applications without recording body contents, and cross-device signal logs covering screen lock states, Wi-Fi networks, Bluetooth accessories, and ambient lighting.

A dedicated database stream named ContextualUnderstanding.PhysicalSocial includes schema fields for logging individuals by name, phone number, and email alongside physical encounter start and end timestamps. In graph.db, relationships operate through forty-six relationship type classes. When mapping an edge such as an employer relationship, the database splits the association across two rows linked by a shared relationship identifier. One row assigns the category predicate, while the second links the subject identifier to the organization identifier, allowing the operating system to retract edges or adjust relationship confidence ratings over time.

Every Mac comes with an (undocumented) family: why it matters

The construction of graph.db creates an unencrypted, plaintext dossier on local storage that sits directly behind macOS Transparency, Consent, and Control Full Disk Access boundaries. While Apple designed the store as a retrieval layer for local large language models under the Apple Intelligence umbrella, the centralized nature of the database turns fragmented behavioral signals into a structured relational inventory. When an application or elevated process secures storage clearance, it bypasses the need to query individual system applications separately.

Security researchers Dario Pasquini, publishing as the Bishop, and Nic Lydon demonstrated that this design establishes a single architectural point of failure for personal privacy. In technical demonstrations using a custom local inspection dashboard named iKnow, researchers showed that an attacker gaining access to the directory can extract kinship trees, household member ages, and historical activity patterns. When coupled with an uncensored local model, an unauthorized extractor can systematically interrogate the structured database to profile the machine owner and their closest associates.

Every Mac comes with an (undocumented) family: who is affected

The background knowledge construction pipeline operates across all Mac hardware running macOS 13 or later, encompassing standard Intel configurations as well as Apple silicon processors. The daemon routines execute regardless of whether a user deliberately configures Apple Intelligence features, maintaining background collection across standard personal workflows. Any Mac user maintaining active local accounts linked to native communication tools, synchronized photo libraries, or iCloud Family Sharing has data processed into the underlying relational schema.

The system also categorizes external individuals who never agreed to Apple software terms. Because the daemons process incoming email headers, message participant lists, shared calendar invites, and faces detected in images, non-users become nodes within the graph. Edge records store children's ages drawn from Family Sharing configurations alongside inferred professional affiliations and physical co-presence patterns, incorporating external colleagues and family members into the local store without external consent.

Every Mac comes with an (undocumented) family: what to watch

System administrators and users must monitor how Apple expands the 181 entity classes and behavioral activity classifications defined inside class.json. The schema already incorporates implemented activity classes such as working, meeting, shopping, and communicating activities, while classifications for eating, traveling, and watching television remain unverified or partially implemented. Observers should track whether Apple adds explicit user-facing toggles in future macOS updates to disable knowledgeconstructiond and intelligenceplatformd processing without breaking dependent operating system features.

Future inspection will center on how local models interact with the triple store through Apple Intelligence retrieval interfaces. Researchers plan to scrutinize whether upcoming macOS releases encrypt individual databases within ~/Library/IntelligencePlatform or introduce granular permission prompts for third-party tools seeking Full Disk Access. Until architectural revisions take place, local tools like iKnow provide the only direct mechanism for users to audit the exact relationship confidence scores, entity linkages, and social records compiled on their machines.