How to Check if Apps on Your Mac Are Secretly Recording You

Let us start with an uncomfortable fact: right now, multiple apps on your Mac probably have permission to record your screen, listen through your microphone, or watch through your camera. And you probably gave them permission to do it.

That does not mean they are actively recording you. But it means they could, at any time, without asking again. And you would have very little way of knowing.

Here is how to find out exactly what has access to what, and what to do about it.

Checking camera access

The camera is the one most people worry about, so let us start there.

How to check: Open System Settings. Click Privacy and Security. Click Camera.

You will see a list of every app that has asked for and received camera access. Each app has a toggle next to it. If the toggle is on, the app can activate your camera at any time.

What to look for: Count the apps on the list. If there are more than five, you probably have some that do not need camera access. Look for apps that have nothing to do with video calls, photos, or streaming. A text editor with camera access is a red flag. A calculator app with camera access is a bigger one.

How to fix it: Toggle off any app that does not need camera access. If the app genuinely needs it later, macOS will prompt you to re-enable it. There is no downside to being conservative.

Checking microphone access

Microphone access is arguably more concerning than camera access because it is harder to detect. Your Mac has a green indicator light for the camera but no equivalent indicator for the microphone.

How to check: System Settings, Privacy and Security, Microphone.

What to look for: The list is usually longer than the camera list. Browsers, communication apps, music software, voice assistants, and recording tools will all be here. But so might apps that have no obvious reason to listen.

Pay special attention to apps you installed a long time ago and no longer use. They still have microphone access even if you have not opened them in months.

How to fix it: Same approach as the camera. Toggle off anything that does not need it. Be aggressive. You can always re-enable it.

Checking screen recording permissions

Screen recording is the most powerful and potentially dangerous permission on your Mac. An app with screen recording access can capture everything on your screen, including passwords as you type them, private messages, financial information, documents, and anything else you look at.

How to check: System Settings, Privacy and Security, Screen Recording.

What to look for: This list should be short. Legitimate reasons for screen recording access include video conferencing apps (for screen sharing), screenshot tools, and screen recording software.

If you see apps on this list that you do not use for screen sharing or recording, revoke their access immediately.

What makes this dangerous: Unlike camera and microphone access, screen recording captures everything across all apps. A compromised app with screen recording access has complete visibility into everything you do on your computer.

Checking accessibility permissions

Accessibility permissions are often overlooked but they are extremely powerful. An app with accessibility access can control your keyboard, mouse, and interact with other apps on your behalf. Malware with accessibility access can log keystrokes, click buttons, and manipulate other applications.

How to check: System Settings, Privacy and Security, Accessibility.

What to look for: Legitimate apps that need accessibility access include password managers (to autofill), automation tools, screen readers, and some productivity utilities. The list should not be long.

Checking input monitoring

Input monitoring permission allows an app to monitor your keyboard and mouse input across all apps, even when the monitoring app is not in the foreground. This is essentially keylogging capability.

How to check: System Settings, Privacy and Security, Input Monitoring.

What to look for: This list should be very short. Legitimate uses include keyboard customization apps and some security tools. If you see something unexpected here, investigate immediately.

Checking full disk access

Full disk access gives an app permission to read files across your entire system, including areas that are normally protected, like Mail, Messages, Safari data, and Time Machine backups.

How to check: System Settings, Privacy and Security, Full Disk Access.

What to look for: Backup tools, antivirus software, and disk management utilities might legitimately need this. Most other apps do not.

The hidden indicators you should know about

macOS has some built-in indicators that something is accessing your hardware, but they are easy to miss.

The green camera dot

When any app activates your camera, a green dot appears in the menu bar near the clock. This is a hardware-level indicator that cannot be spoofed by software. If you see the green dot when you are not on a video call, something is using your camera.

The orange microphone dot

When an app is using your microphone, an orange dot appears in the menu bar. Like the camera indicator, this is reliable but easy to miss if you are not looking at the menu bar.

Control Center details

Click the Control Center icon in the menu bar (the two-toggle icon) when you see a green or orange dot. It will show you which app is currently using the camera or microphone.

Why checking manually is not enough

The manual process we just described works, but it has real limitations.

You have to remember to check regularly. Permissions accumulate over time as you install new apps and grant access without thinking. If you only check once a year, months of new permissions go unreviewed.

You have to check multiple categories separately. Camera, microphone, screen recording, accessibility, input monitoring, full disk access, and more. Each one is a separate click-through in System Settings.

You have to know what is normal and what is not. Seeing "com.apple.accessibility.MotionTrackingAgent" in your accessibility list might look scary but is actually a legitimate Apple process. Meanwhile, a friendly-sounding app name might be hiding something concerning.

How CoreLock simplifies this entirely

CoreLock's privacy audit scans every permission category on your Mac in a single pass and presents the results in one unified view. No clicking through six different sections of System Settings.

More importantly, CoreLock does not just list the permissions. It analyzes them. It flags permissions that look unusual, explains why an app might not need a particular permission, and tells you the risk level in plain English.

If you want to revoke a permission, you can do it directly from CoreLock. No digging through System Settings.

And because CoreLock is a security tool, not just a permission viewer, it correlates permission data with process analysis, code signature verification, and network monitoring. An app with camera access that is also making suspicious network connections gets flagged differently than an app with camera access that is behaving normally.

Want to see everything that has access to your Mac? Download CoreLock for free at corelock.ai/download and run a privacy audit in under a minute. You might be surprised by what you find.