What Is knowledge-agent on Mac? 42 Bad Frames Every Night

knowledge-agent is the per-user half of CoreDuet, the part of macOS that records what you do so Siri suggestions, Screen Time and the share sheet can use it later. It keeps knowledgeC.db open in ~/Library/Application Support/Knowledge, answers queries from other system agents, and once a night runs a privacy cleanup over that data. On my Mac mini it used 38.7 seconds of CPU in almost 22 days, about 0.002% of one core. It is not a CPU problem here.

What I did not expect was the log. Every night between 23:48 and 23:53 the cleanup job opens one Biome file, hits the same 42 corrupt frames at the same offsets, logs two errors per frame, and skips them. It has done that on every night the log still covers. Since Oct 19 a second error has also been repeating every hour. Below is what the agent is, what it did in a day, and what those two errors are, as far as a shell without root can tell.

The rig is a headless Mac16,10 (M4) on macOS 26.4.1 (25E253), up 21 days 22 hours, with no Apple Account signed in, measured on 2026-10-20 as an admin user without sudo.

Where knowledge-agent comes from

$ ps -axo pid,user,etime,time,rss,comm | grep [k]nowledge-agent
  854 sg-mini   21-22:43:34   0:38.72  16256 /usr/libexec/knowledge-agent

$ launchctl print gui/501/com.apple.knowledge-agent | grep -E "runs|immediate|last exit"
	runs = 1
	immediate reason = xpc event
	last exit code = (never exited)

launchd starts it from /System/Library/LaunchAgents/com.apple.knowledge-agent.plist, so there is one copy per logged-in user and it runs as you, not as root. If the difference between the two launchd folders is new to you, LaunchAgent vs LaunchDaemon covers it. The plist sets RunAtLoad, EnablePressuredExit and ProcessType Adaptive, so macOS may stop it under memory pressure and start it again when an event arrives. On this Mac it has started once and never exited.

The binary is a 402,784-byte universal file (x86_64 and arm64e) that links CoreDuet, CoreDuetSync, PeopleSuggester and BiomeFoundation. Unlike its neighbours it has no man page. man duetexpertd, man suggestd, man biomed and man BiomeAgent all exist; man knowledge-agent returns "No manual entry". The closest thing to a description I found is Howard Oakley's list of CloudKit clients, which describes com.apple.knowledge-agent as "for Siri suggestions and related knowledge services" (Eclectic Light).

What it holds open and what it may touch

lsof -p 854 shows three data stores:

• ~/Library/Application Support/Knowledge/knowledgeC.db, opened read-write: 495,616 bytes plus a 2.1 MB write-ahead log.
• /private/var/db/CoreDuet/People/interactionC.db, opened read-only. This is the "people" store behind contact suggestions.
• One Biome segment, ~/Library/Biome/streams/restricted/App.Intent/local/800523711686985, a 1 MB file.

knowledgeC.db is well known to forensic examiners. Belkasoft's guide puts the user copy in ~/Library/Application Support/Knowledge/, says it "typically includes about one month of records", and notes that from macOS 13 on "most of the data that was previously stored in knowledgeC.db is recorded in the Biome database" (Belkasoft). That matches what I see: the old database is still open, but most of the agent's reads go to Biome streams.

The code signature carries 37 entitlements. The ones that explain the job:

• com.apple.private.tcc.allow: Calendar, Reminders, Contacts and kTCCServiceLiverpool, granted without a prompt.
• com.apple.private.biome.pruner for 13 streams, including Siri.Remembers.CallHistory, Siri.Remembers.MessageHistory, App.InFocus and Media.NowPlaying. It is allowed to delete from those, which fits the cleanup job below.
• com.apple.private.biome.writer for App.Activity and App.LocationActivity.
• CloudKit containers com.apple.knowledgestore2 and knowledgestore4, which is how this data syncs between your devices when an account is signed in.

Strings in the binary spell out its cleanup rules: "Deleted %lu interactions to keep max count at %lu", "Deleted %lu first-party allowlisted interations older than %@" (Apple's typo), and a telemetry line with LifespanLimitDeleted, TotalLimitDeleted and UserDoesNotExistDeleted. So it deletes by age, by a total cap, and for user accounts that no longer exist.

One day of work, from the unified log

I pulled seven days of its log with /usr/bin/log show --last 7d --info --debug --predicate 'process == "knowledge-agent"'. That returned 3,318 lines, but Default-level lines only reach back to 13:19 on Oct 19; before that, only Error lines and a few Info lines survive. (If log show prints nothing in zsh, the Mac log show command notes explain why: the shell has a builtin named log.) In the 21 hours with full detail:

Work	Count	Notes
Queries from UsageTrackingAgent	801	all over the /notification/usage stream; 747 returned 0 events; 0.70 s in total
people.refresh-cache activity	21	hourly, about 18 minutes past; rebuilds FaceTime, calendar and reminder suggestions
Queries from ScreenTimeAgent	21	one per hourly run
maintainPrivacy, the nightly cleanup	1	23:53:10, done in 85 ms, "Deleted 0 orphaned entities"

That is the shape of the job: a service other agents ask about your recent activity, an hourly suggestion refresh, and a nightly prune. On a Mac with no account, no Messages and no FaceTime history, nearly every answer is empty.

The 42 frames it skips every night

Here is the nightly run on Oct 19, trimmed:

23:53:10.815  CoreDuet: com.apple.coreduetd.maintainPrivacy
23:53:10.816  [Storage] Starting executeQuery for '_DKDeviceActivityStandingQuery'
              ... over streams ( "_DKEventStream: { name=/activity/level ...
23:53:10.818  Successfully mapped file: /private/var/db/biome/streams/restricted/
              _DKEvent.Activity.Level/local/800512604660814 ... offset:0 size:32
23:53:10.818  Successfully mapped file: ... offset:32 size:1048544
23:53:10.818  isValidFrame failed, path:.../800512604660814, offset:34088
              error:Error Domain=com.apple.Biome.BMFramestore Code=5
23:53:10.818  isValidFrame returned a 5 error for frame number:266 at offset 34088,
              skipping frame in segment: ...
23:53:10.837  [Storage] Completed executeQuery for '_DKDeviceActivityStandingQuery'
              with success=1, count=0. Error: (null). Elapsed: 0.021s.

The pair of errors repeats for 42 frames, offsets 34,088 through 39,336 in steps of 128 bytes. Error-level lines survive longer than the rest, back to 23:52 on Oct 12, so I could check each night:

• Oct 13 to Oct 19: 42 failed frames every night, always segment 800512604660814, always Code=5, always the same 42 offsets. That makes 297 failures in the window: 42 times 7, plus 3 at the very start of the retained log on Oct 12.
• The query still reports success=1. Nothing is repaired, and the same frames are skipped again the next night.

Two checks on the file itself. The segment name reads as a Mac absolute timestamp in microseconds: 800,512,604,660,814 µs after 2001-01-01 is 2026-05-15 04:36:44 UTC, so the file dates from mid-May. And the first mapping is 32 bytes, then the rest of a 1 MB file, which matches the 32-byte header of the SEGB v2 format that the segb-core crate documents for Biome files (segb-core docs). I could not look inside. /private/var/db/biome belongs to _biome, and listing the stream folder returns "Permission denied". The log shows the agent getting its file handle through _BMXPCFileManager, a route a shell does not have.

What I did not do: delete or move the segment. It needs root, it belongs to the system, and the agent copes with it. The cost is 84 error lines and about 20 ms a night. If you see isValidFrame failed in your own log, it is probably the same kind of thing: a damaged stretch of an older Biome segment that the reader steps over.

A second error, new since Oct 19

The other recurring error comes from PeopleSuggester code inside the agent, two lines per hourly refresh:

error in creating subdirectory at path: <private> with error:
Error Domain=NSCocoaErrorDomain Code=513 ... {Error Domain=NSPOSIXErrorDomain Code=13}

Code 513 is Cocoa's "no write permission" error and POSIX 13 is EACCES. The path is redacted. I looked for a kernel sandbox denial in the same second, which sometimes names a redacted path, and found none, so this is a plain file permission refusal. It first appears at 14:19:22 on Oct 19 and has repeated at all 21 hourly runs since, 42 lines in total. The Error-level log reaches back to Oct 12 with no such line before then. What I can't tell is whether the hourly job only began on Oct 19 or began failing then, because the Default-level lines that would show earlier runs are gone.

How it compares with its neighbours

knowledge-agent sits near the bottom. The process to ask about is duetexpertd, with 1,266 seconds, 33 times as much. Its man page says only that it "powers personalized system experiences". It also turned up in my cfprefsd measurements: 127 of 137 rejected preference reads in one hour came from duetexpertd trying to read Trial settings its sandbox does not allow.

Should you disable knowledge-agent?

The user reports I found are about crashes and old versions, not CPU. In an Apple Community thread from August 2018 on macOS 10.13, a user saw "Knowledge-agent quit unexpectedly" a few times a day; their EtreCheck report logged 100 crashes with an NSRangeException, and they fixed it by erasing and reinstalling macOS (Apple Community). On Hacker News in October 2026, one commenter put knowledge-agent on a list of 60-odd processes they would rather run without, for speed and privacy, with no measurements (HN). An older Ask HN asked why the related ~/Library/IntelligencePlatform databases get so little attention (HN).

I did not disable it. The plist registers Mach services other agents call, including com.apple.coreduetd.knowledge.user, which is how UsageTrackingAgent and ScreenTimeAgent asked their 822 questions in 21 hours. Turning it off with launchctl disable would most likely leave those callers without answers rather than make the Mac faster, and on this machine there is no CPU to win back. If privacy is the worry, the stored data matters more than the process, and Siri and Screen Time settings decide what gets recorded. For another Apple Intelligence cleanup on the same Mac, see removing Apple Intelligence Mac storage.

FAQ

What is knowledge-agent on Mac?

knowledge-agent is a macOS system process at /usr/libexec/knowledge-agent, started per user by /System/Library/LaunchAgents/com.apple.knowledge-agent.plist. It is part of CoreDuet: it keeps the knowledgeC.db activity database in ~/Library/Application Support/Knowledge open, answers queries from Screen Time and usage tracking, refreshes contact and calendar suggestions hourly, and prunes old records nightly.

Is knowledge-agent a virus?

No. It ships with macOS on the read-only system volume and is launched by an Apple LaunchAgent plist. A process with that name running from any other folder, or signed by anyone but Apple, would be worth checking with codesign -dv.

What does "isValidFrame failed" from knowledge-agent mean?

It means a record inside one of the Biome stream files is damaged. The reader logs the failure, skips the frame and carries on, and the query still succeeds. On a test Mac mini the same 42 frames in one segment from May 2026 failed every night for a week with no other effect.

Measured on 2026-10-20 on one headless Mac mini (Mac16,10, M4, macOS 26.4.1 build 25E253, up 21 days 22 hours), no Apple Account signed in, as an admin user without sudo. Process and CPU figures are from ps, open files from lsof, entitlements from codesign. Log counts come from two /usr/bin/log show captures of the knowledge-agent process: seven days at all levels (3,318 lines, full detail only from 2026-10-19 13:19) and Error level over 25 days (636 lines, back to 2026-10-12 23:52). I did not open knowledgeC.db or the Biome files, and I changed nothing. Background comes from Eclectic Light, Belkasoft and the segb-core docs; user reports from one Apple Community thread and two HN threads.