Click to Skip Ad
Closing in...

Software engineer may have discovered serious macOS privacy concern

Updated 2 months ago
Published Oct 5th, 2022 12:48PM EDT
2022 MacBook Air Design Epic Health
Image: Christian de Looper for BGR

Engineer Matt Hodges posted a Twitter thread about an issue he found on macOS. According to him, not only does the Mac operating system actively scan images in the background, but when these images are QR Codes that point to an URL, macOS is decoding them, and requesting the URL. As a company that talks about “privacy as a fundamental right,” this raises the question of whether this is “just a bug” or intended by Apple.

UPDATE | 10/5 at 2:40 PM ET: Hodges provided an update on Wednesday backtracking from his initial claim. The tweet follows below, as does the original story:


According to Hodges, he was “playing with Canary Tokens,” which lets you create a digital artifact such as a file, URL, or QR Code, and if someone interacts with it, you get an alert, and discovered this macOS issue. He explains how he discovered this:

When you make a QR code canary token, the service points the code to some placeholder website, and when that website is fetched, they send you an email with details like IP address and User Agent that scanned the code. Here’s one that emails example@example.com when scanned.

He decided it had no use for him and just “let it sit in my Downloads Folder.” Then, he got “a flurry of emails saying it had been triggered.” With that, he discovered that what was triggering the QR Code was his own IP, and the User Agent was from an AppleKit tool from macOS. He writes:

So macOS is background scanning all the images on my computer. I’m not totally shocked — they do all that face tagging and magic cat-breed identification now. But they’re also 1) decoding QRs & 2) requesting random URLs! That seems like both a privacy and a security problem.

While Apple scanning images in the background is not a big deal since it uses that to detect objects and classify them within the Photos app – Apple says this part is end-to-end encrypted –, it’s not usual for the company to read, decode, and check the QR Code content without user’s consent.

Fortunately, according to another Twitter user, this issue is only Mac-related and does not affect the iPhone.

BGR reached out to Apple and asked for a comment. We’ll update the story once we receive a response.

More Apple news: This new iOS 16 feature is so useful, but no one knows about it

José Adorno Tech News Reporter

José is a Tech News Reporter at BGR. He has previously covered Apple and iPhone news for 9to5Mac, and was a producer and web editor for Latin American broadcaster TV Globo. He is based out of Brazil.