macOS 13+ Includes Undocumented Daemons for Personal Knowledge Graph Construction

Undocumented Daemons Discovered

Since macOS 13 (2022), every Mac ships with a pair of daemons whose function is to construct a detailed personal knowledge graph. This graph maps user identity, relationships, communication patterns, locations, and activities. The existence and full functionality of these daemons are not officially documented by Apple.

Data Collection and Inference

The personal knowledge graph is built on-device by cross-referencing data from multiple sources, including Contacts, Calendar, Photos, Messages, Mail, location services, and Screen Time. It also incorporates a range of behavioral signals. The system infers relationships and activities based on this aggregated data.

Integration with LLMs

The constructed graph is maintained as a queryable store, which is reportedly accessed by Large Language Models (LLMs). While Apple researchers published a paper in 2023 on the techniques behind graph construction, there is limited information on its integration into macOS, specific data collected, or the inference of 'kinship' relationships.

Prior Observations

The daemons were encountered during security research on the Apple Intelligence bundle in macOS 26. Separately, Nic Lydon also identified the same database and documented it in a personal knowledge graph context. The only official mention is a brief man page entry for 'knowledgeconstructiond'.