A camera or microphone turning on when you did not expect it is one of the more unsettling things a Mac can do. Before installing anything, it helps to know that macOS already answers most of “which app is doing this” on its own, in a few specific places. Here they are, in the order worth checking.
The green light beside the camera
Apple is direct about this one: a green light beside the camera glows to indicate the camera is on. If that light is lit and you did not open a video call, that is the first and simplest sign that some app has turned the camera on right now.
The recording indicator in Control Center — it names the app
For the microphone, Apple adds a second layer: the Recording Indicator light in Control Center shows when the microphone is in use or has been used recently. That orange or green dot sits in the menu bar, next to the clock, and it is not just a light. Apple’s guide to Control Center is explicit: “The privacy indicator dots in the menu bar are part of Control Center. Click any dot to see which app is currently using your microphone, camera, or system audio.” Click it, and macOS names the app for you, no extra software involved.
System Settings: the full list, and the switches
Control Center only shows what is active right now. For the complete list, and the switches to turn access on or off, go to Apple menu › System Settings › Privacy & Security › Camera, and the same page for Microphone. Every app that has ever asked is listed there, whether or not it is using the camera or microphone this second, with a toggle for each.
On a laptop with the lid closed
On Apple silicon Mac laptops, and Intel-based Mac laptops with the Apple T2 Security Chip, there is a hardware backstop that needs no light and no setting. Apple’s Platform Security guide states that these laptops “feature a hardware disconnect that turns off the microphone whenever the lid is closed,” designed to prevent any software, even with root or kernel privileges, from engaging the microphone while the lid is shut. The camera does not get the same hardware cut, because, as Apple puts it, its “field of view is completely obstructed with the lid closed” anyway.
| Where to look | What it tells you |
|---|---|
| Green light beside the camera | The camera is on, right now |
| Recording indicator dot in Control Center | Click it: names the app currently using the camera, microphone or system audio |
| System Settings › Privacy & Security | Every app that has ever asked, with a switch for each |
| Lid closed (Apple silicon / T2 laptops) | Microphone is cut off in hardware; the camera is not, but its view is already blocked |
What none of this shows: where it goes
All four checks answer “is it on, and which app.” None of them show what that app then does with the picture or sound, or where any of its network traffic goes while it is capturing. A video call is supposed to stream to the calling service; an app quietly uploading to a server you have never heard of looks identical from the green light’s point of view. That gap is on the network side, which is where a firewall, not a permissions screen, comes in.
What FireAI 0.1.2 adds
- The moment an app turns on the camera or microphone, FireAI shows it on the World map, with how long it has been on. The microphone’s app comes straight from macOS, so it is exact; the camera’s is labelled “probably”, because macOS has no public way to ask which app holds the camera — FireAI names whichever app is on the microphone at the same time, or else the frontmost app.
- That app’s connections light up on the globe while the device is on: green for the camera, orange for the microphone, the same colours as macOS’s own indicators, showing which companies and countries it is talking to.
- A local “Camera & mic” log records each session: the app, the time, the duration, bytes sent and received, and the top destinations.
- A “Stop it” menu can remove that app’s camera or microphone access on the spot (macOS will ask again next time), quit the app, or block its internet with a reversible FireAI rule.
The short version
The green light and the Control Center indicator are your first-look answer to “is something using it, and which app.” System Settings is your lock. What was missing was the network side — where that app’s traffic goes while it can see or hear you — which is the part FireAI now shows on the map.
How FireAI and HisnLabs fit in
FireAI 0.1.2 picks up exactly where these built-in signals stop: the moment the camera or microphone turns on, it shows which app and where that app’s traffic goes on the world map while it can see or hear you.
FireAI is HisnLabs’ own product: an on-device AI firewall for Mac. It shows every connection your apps make, in plain language, and lets you decide what leaves your Mac — its AI runs locally, so your traffic is never sent to us or anyone else. HisnLabs’ security research team is the group that keeps that decision-making accurate: cataloguing which domains are ordinary telemetry versus a real product, tracking the country and network behind a connection, and training the on-device model (its Autopilot feature) on real traffic patterns, all without any of it leaving your Mac.
You can read the technical decisions behind it, or try FireAI for 17 days, at FireAI, by HisnLabs.