A firewall that only watches the apps you installed is watching half the picture. macOS itself makes a steady stream of outbound connections — checking software updates, syncing iCloud, validating app signatures — and one of those channels was, for a while, effectively impossible for a user to block.
The trustd discovery
On 12 November 2020, security researcher Jeffrey Paul documented that macOS Big Sur sends a hash identifying every app you open to Apple’s servers, over an unencrypted connection, as part of a certificate-revocation check (OCSP). Each request carried the app’s identifier, your IP address and a timestamp — in effect, a log of what you run and when, sitting on the wire in plain text.
The process making these checks, trustd, was placed on a system list that content-filtering tools like Little Snitch could not intercept or block, so turning on a firewall or a VPN did nothing to stop it. Paul’s point was not that Apple was reading the logs itself — it was that anyone positioned to see the traffic, from your ISP to a network eavesdropper, could.
It is not the only channel
OCSP checks are one example of a broader pattern: Software Update checks in for new versions on its own schedule, iCloud and Handoff keep multiple background connections open across your devices, and Siri suggestions and Spotlight can reach out to Apple for results — all before you have opened a single third-party app.
What this means for you
- macOS’s own background traffic is real, documented, and in at least one case was proven to bypass user-installed firewalls entirely.
- This is a privacy and visibility issue more than a malware one — the traffic is Apple’s own, but you had no way to see or choose it.
- A tool that shows connections at the network level, not just the ones an app declares, is the only way to know what is actually leaving your Mac.
How FireAI and HisnLabs fit in
None of this makes macOS malicious — it makes it a computer with its own opinions about what should go online, which is exactly why a firewall that shows every connection, from every process, matters even if you never install a single risky app.
FireAI is HisnLabs’ own product: an on-device AI firewall for Mac. It shows every connection your apps make, in plain language, and lets you decide what leaves your Mac — its AI runs locally, so your traffic is never sent to us or anyone else. HisnLabs’ security research team is the group that keeps that decision-making accurate: cataloguing which domains are ordinary telemetry versus a real product, tracking the country and network behind a connection, and training the on-device model (its Autopilot feature) on real traffic patterns, all without any of it leaving your Mac.
You can read the technical decisions behind it, or try FireAI for 17 days, at FireAI, by HisnLabs.