A version of this story circulates in security write-ups, some of them now generated by AI assistants: macOS’s background indexing daemon, mdworker, supposedly fetches the remote images inside any HTML file you download, so a file you never open can still report your IP address to whoever sent it. It is a good story. It is also the kind of claim that should be tested before it is repeated, so we tested it.
Three different things happen to a new file
The claim blurs three separate mechanisms. When a file lands on disk, Spotlight’s metadata server hands it to an importer plug-in, run inside a mdworker_shared process, which extracts text and attributes so the file becomes searchable (mdimport and mdls are the command-line windows onto this). Separately, when Finder needs an icon, Quick Look Thumbnailing renders a small thumbnail. And only when you select the file and press Space does Quick Look render a full preview. Each of these can behave differently, so each needs its own test.
The test
We ran a tiny HTTP listener on the loopback address that logs every request with its User-Agent, then created two files in ~/Downloads pointing at it: an HTML page with a one-pixel image and an external stylesheet, and an SVG with an embedded external image. Loopback keeps the experiment self-contained; a remote tracking server would receive the same requests, plus your public IP address.
<html><head><title>Q3 Financial Report</title></head><body>
<h1>Financial Summary</h1>
<img src="http://127.0.0.1:8765/html-img.png" width="1" height="1">
<link rel="stylesheet" href="http://127.0.0.1:8765/html-css.css">
</body></html><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100">
<image xlink:href="http://127.0.0.1:8765/svg-image.png" width="100" height="100"/>
</svg>1. Just downloading it: Spotlight indexing
We waited 40 seconds after creating the files, then confirmed Spotlight had indexed them. The listener had received nothing.
mdls -name kMDItemContentType ~/Downloads/fireai-lab-test/q3-report.html
kMDItemContentType = "public.html"
# listener log: empty2. Forcing the Spotlight importer
To rule out timing, we ran the importer by hand. It used Apple’s RichText importer, extracted 37 attributes, and made no request.
mdimport -t -d1 ~/Downloads/fireai-lab-test/q3-report.html
Imported '…/q3-report.html' of type 'public.html' with plugIn /System/Library/Spotlight/RichText.mdimporter.
37 attributes returned
# listener log: still empty3. The Finder icon: Quick Look thumbnail
qlmanage -t -s 256 -o /tmp ~/Downloads/fireai-lab-test/q3-report.html ~/Downloads/fireai-lab-test/badge.svg
* …/q3-report.html produced one thumbnail
Done producing thumbnails
# listener log: still empty4. Pressing Space: the Quick Look preview
qlmanage -p opens the same preview panel as selecting a file in Finder and pressing Space (qlmanage). This time the listener lit up immediately, for both files:
qlmanage -p ~/Downloads/fireai-lab-test/q3-report.html
13:40:22.408 GET /html-img.png UA=Mozilla/5.0 (Macintosh; …) AppleWebKit/605.1.15 … Safari/605.1.15
13:40:22.408 GET /html-css.css UA=Mozilla/5.0 (Macintosh; …) AppleWebKit/605.1.15 … Safari/605.1.15
qlmanage -p ~/Downloads/fireai-lab-test/badge.svg
13:40:30.035 GET /svg-image.png UA=Mozilla/5.0 (Macintosh; …) AppleWebKit/605.1.15 … Safari/605.1.15| What the user did | Mechanism | Remote request? |
|---|---|---|
| Nothing (file downloaded) | Spotlight importer in mdworker_shared | No |
| Nothing (forced import) | mdimport, RichText importer | No |
| Looked at the folder | Quick Look thumbnail (Finder icon) | No |
| Selected the file, pressed Space | Quick Look preview (WebKit) | Yes: image, stylesheet, SVG image |
What this means
The “zero-click” version is not what we measured: a file that sits in Downloads, is indexed by Spotlight and shown as an icon did not call out. That matters, because a defence built on a wrong model wastes effort in the wrong place. Blocking mdworker from the network, for example, would not have changed anything in this test.
The one-key version is real. Quick Look’s preview renders HTML and SVG with WebKit and loads their remote resources, so a single press of Space on an attached “report” tells the sender that the file was looked at, when, and from which IP address. That is a web beacon, the same trick that email tracking pixels use and that Apple’s Mail Privacy Protection exists to blunt in Mail; it simply is not covered when the same content arrives as a file. In attacker terms it is reconnaissance, not compromise: MITRE ATT&CK T1598 catalogues this kind of information gathering before a real attack.
Limits of this test
- One macOS version (26.7) and one run per case. Behaviour may differ on other versions; rerun it on yours, the files above are all you need.
- We used a loopback address. A public URL behaves the same for WebKit, but we did not measure it here.
- We tested HTML and SVG. Other types with remote references (for example
.webarchive, Office documents with linked images, or third-party Quick Look extensions) were not tested and may behave differently in either direction. qlmanage -pis Apple’s debugging front end for the preview; Finder’s Space-bar preview uses the same framework, but we did not instrument Finder itself.
What to do
- Treat Quick Look on an untrusted HTML or SVG file as opening it. If you want to inspect one safely, read it as text:
cat file.html, or open it in a plain-text editor. - Check a file’s type before previewing:
mdls -name kMDItemContentType filetells you what Quick Look will render it as, whatever its icon suggests. - Watch which process makes the connection, not just whether one happens. Here it was the WebKit preview acting on Apple’s behalf, which is why rules that only trust or distrust “apps you installed” miss it.
The broader lesson is about method. The dramatic version of this story was confidently written and would have been easy to publish. Twenty minutes with a listener and four commands showed where it was wrong and where the real, smaller risk is.
How FireAI and HisnLabs fit in
The fetch in this test came from a WebKit preview running on Apple’s behalf, not from an app you installed, which is exactly the kind of connection a per-app firewall exists to show you: FireAI lists the process, the destination and the country, and lets you deny it.
FireAI is HisnLabs’ own product: an on-device AI firewall for Mac. It shows every connection your apps make, in plain language, and lets you decide what leaves your Mac — its AI runs locally, so your traffic is never sent to us or anyone else. HisnLabs’ security research team is the group that keeps that decision-making accurate: cataloguing which domains are ordinary telemetry versus a real product, tracking the country and network behind a connection, and training the on-device model (its Autopilot feature) on real traffic patterns, all without any of it leaving your Mac.
You can read the technical decisions behind it, or try FireAI for 17 days, at FireAI, by HisnLabs.