AI Activity
Network extension
Turn on Cloak Watch's network extension to see which apps and agents talk to AI providers, how much and when, without decrypting traffic, and how it fails open.
Cloak Watch’s network extension shows which apps on your Mac talk to AI providers such as Anthropic and OpenAI, how much they send, and when. It covers every app at once, including ones Watch can’t connect to, like desktop chat apps and editors. It never decrypts anything: it sees who talked to whom, never what they said.
What it sees
Section titled “What it sees”| It records | It never sees |
|---|---|
| The app or process (Claude Code, Cursor, Python, node and so on) | Prompts, code, replies or any other content |
| The AI provider’s host name | The contents of any other connection |
| Bytes sent and received, when, and for how long | Local models on your own Mac (Ollama, LM Studio), which talk over loopback |
The extension takes only TCP connections on ports 443 and 8443 to the AI providers Watch knows (22 remote services built in) and relays them straight to the provider. Everything else on your Mac goes past it untouched. It reads the TLS server name to tell which provider a connection is for; for command-line agents connecting to an address Watch hasn’t looked up yet, it reads that name from the connection’s first message, and records the connection only if it names an AI host.
It refuses QUIC (HTTP/3 over UDP) to AI hosts only, so those apps fall back to ordinary TLS over TCP, which it can see.
Network alerts
Section titled “Network alerts”The extension also looks at which program opens each outgoing connection on ports 80, 443 and 8443, and on any port to cloud metadata addresses and to IP addresses an incident names, and where it goes, to raise network alerts: an install script asking for cloud credentials, a request catcher, an incident’s address. It keeps a record only of the connections that match, never what they send, and passes every one of them straight through: only AI connections are relayed.
Records show in AI Activity’s timeline as network events (seen by network), in the Connections table’s Network column, and in the AI today line.
Turn it on
Section titled “Turn it on”Cloak Watch must be in your Applications folder. Elsewhere, Watch says Move Cloak Watch to Applications.
-
Open AI Activity › Connections, select any tool, and click Set Up… next to Network. Or click See what AI tools send under Get more from Watch on Home, or turn on Network Extension in the menu bar.
-
In the Watch AI traffic sheet, click Continue.
-
macOS blocks the new system extension until you allow it. Watch shows Allow it in System Settings. Open System Settings › General › Login Items & Extensions (macOS 15 and later; click ⓘ next to Network Extensions) or System Settings › Privacy & Security (macOS 14), and allow Cloak Watch. Enter your password when asked.
-
macOS then asks whether Cloak Watch may add proxy configurations. Click Allow.
The menu bar switch and the Network item in AI Activity’s status bar then show On, with how many apps it saw recently, for example On · 3 apps recently.
Turn it off and on
Section titled “Turn it off and on”- Turn it off with the Network Extension switch in the menu bar. New AI connections go direct at once; connections already open finish normally. Turn the switch on again to resume.
- Turned off in System Settings. If you turn Cloak Watch off under Network Extensions in System Settings, Watch says Turned off in System Settings and never turns it back on by itself. Use the menu bar switch to turn it on again.
| State | Meaning |
|---|---|
| Off | Not running; all traffic goes direct |
| Allow it in System Settings | Waiting for you to allow the extension |
| Starting | Starting up |
| On · N apps recently | Recording |
| Paused after errors; traffic goes direct | It hit repeated errors and is passing everything through for a few minutes |
| Stopped unexpectedly; restarting | Watch is restarting it |
| The network extension stopped | Watch gave up restarting it; turn it on again |
| Turned off in System Settings | You turned it off in System Settings |
| Move Cloak Watch to Applications | The app is outside Applications |
| Not in this build | This copy of Cloak Watch doesn’t include the extension |
| Turned off by Subcloak for now | Subcloak turned the extension off from the signed feed while a problem is fixed; every connection goes direct. Your choice is kept, and it comes back on by itself when Subcloak turns it back on. |
It fails open
Section titled “It fails open”The extension is built so a problem with it never cuts you off:
- If a provider can’t be reached through the extension, that host passes straight through for 60 seconds.
- After five failures within a minute, everything passes straight through for 5 minutes (Paused after errors; traffic goes direct).
- With 256 or more connections open through it, new ones pass straight through.
- If you quit Cloak Watch, the extension keeps relaying on its own and buffers up to 5,000 records; they appear when Watch opens again.
- If the extension stops unexpectedly, macOS sends new connections direct, and Watch restarts it after 2, 10 and 60 seconds before giving up with The network extension stopped. Connections that were in flight when it stopped can fail once.
Use it with Cloak Proxy’s App Capture
Section titled “Use it with Cloak Proxy’s App Capture”Cloak Proxy’s App Capture uses a network extension too, and both can be on at once. Cloak Watch 1.0 and Cloak Proxy don’t coordinate:
- When both extensions want the same connection, Cloak Proxy’s App Capture gets it. In Subcloak’s tests it did every time (10 out of 10). Watch then doesn’t see that app’s AI traffic, so it’s missing from AI Activity while App Capture captures the app.
- Watch records that app again once App Capture stops capturing it.
- Watch’s extension passes Cloak Proxy’s own traffic through, so a request isn’t counted twice.
Remove the extension
Section titled “Remove the extension”Cloak Watch 1.0 has no button that removes the network extension. To take it out of use:
- Turn the Network Extension switch off in the menu bar.
- In System Settings › General › Login Items & Extensions › Network Extensions (macOS 15 and later), turn Cloak Watch off.
- Check System Settings › Network › Filters & Proxies (or VPN & Filters) and remove a leftover Cloak Watch configuration.
To check whether the extension is still installed, run systemextensionsctl list in Terminal and look for com.subcloak.cloakwatch.network.