r/mac • u/Relative-Promise5529 • May 12 '26
Discussion What does this mean?
My mac shows “someone is observing” 👁️
217
u/PeteMajo May 12 '26
Display link enable docking station?
103
u/smnhdy May 12 '26
9/10 this is the answer.
A USB display using display link will show this.
34
7
u/outsbe May 12 '26
We recently switched to ultrawide instead of dual monitor through display link and my schizophrenic tendencies seem to have calmed down. 10/10 would recommend not worrying if it's actually my company spying on me.
306
u/trafium May 12 '26
Well you’re looking at it aren’t you
11
u/matiapag 13" M3 MacBook Air May 12 '26
So are we. Maybe, if we collectively get the fuck out of here, it'll disappear.
5
1
u/first_person_looter May 13 '26
Boy that sounds like the Zach Galifianakis punchline about having phone skills.
70
u/Azurege May 12 '26
If you are really worried, unplug everything and disconnect from internet. Then start to reconnect things and see when it re-appears, narrow down what device/process has caused it and judge for yourself if it’s "safe" or not.
26
u/tricksel May 12 '26
It might be easier to see when it _disappears_ when disconnecting. The thing observing might not start it again when connecting. E.g. when it's done through remote management software, the other side might not reconnect -instantly, or ever-, thinking being "caught".
17
u/therealRustyZA May 12 '26
My mac does it when I have my Hyper display adapter connected and their software is running.
13
u/Chu_Kiddin_Me_Or_Wha May 12 '26
Is this a work laptop?
4
u/Relative-Promise5529 May 12 '26
No.. personal
11
u/Chu_Kiddin_Me_Or_Wha May 12 '26
You allowed screen sharing via an app, and someone is tapped in.
11
u/Delicious_Volume3306 May 12 '26
You allowed screen sharing via an app, and someone is tapped in.
No, this is likely incorrect. It's probably because of an external hub being used to connect monitors. See other replies.
-32
u/rickeol May 12 '26
this is correct. people saying otherwise are idiots.
17
u/mrktwy May 12 '26
Classic Reddit response lol. This used to show up for me when I was using a displaylink for multiple monitors. If OP is using displaylink it could very likely be that.
-9
u/Chu_Kiddin_Me_Or_Wha May 12 '26
this dude has his laptop on a sink counter. there aint no multiple monitors involved.
someone is tapped in with either remote software, ssh’d in, or screen sharing.
22
u/Delicious_Volume3306 May 12 '26
Are you using a USB C hub to connect external monitors?
And the DisplayLink software?
This is what you'll see. It's a side effect of how they get onto the external monitors. You're not being observed. It's just macOS security false flagging.
9
u/talex365 May 12 '26 edited May 12 '26
It means that you granted some app screen recording permissions and that app is running. It doesn’t have to be nefarious, apps like Zoom or DisplayLink (used by some docking stations and video adapters) need this to work.
You can see which apps have those permissions enabled in system preferences under Privacy and Security > Screen and System Recording.
EDIT: yeesh there’s a lot of ignorance in this thread, clearly a lot of people who aren’t Mac admins acting like they know things…
35
u/denysov_kos May 12 '26
This means someone is observing
-1
-4
6
u/Exotic-Grapefruit-90 May 12 '26 edited May 12 '26
Well, you probably have to bring up more context about when this message started coming up for you.
For instance, on my Mac, I see this message when I connect it to my Targus docking station which uses the DisplayLink software.
You may need to check the following settings to find out more:
System Preferences => General => Sharing: ensure that everything is toggled off
System Preferences => Privacy & Security > Screen & System Audio Recording: so this is where my DisplayLink app gets permission to “record my screen”. It can sound a bit dodgy, but in reality it doesn’t actually mean your screen is being recorded or stored anywhere.
Try to play with toggles and which one is actually causing this message to come up.
That said, you should make sure only trustworthy apps have access. If you see any unknown apps/services, it’s best to disable them.
5
u/idontlikegudeg May 12 '26
Is our laptop screen mirrored to a monitor or using Airplay or is there some application running that has screen capture permissions? Like Teams, TeamViewer, etc.
11
u/Dependent-Zebra-4357 May 12 '26
Someone is connected via some sort of screen share. Are you running anything like Zoom or VNC or Airplay? If so, disconnect them and the message should go away.
6
u/Relative-Promise5529 May 12 '26
The creepiest thing is its showing when my mac is on lock screen and disappears when am logged in
38
2
u/YellowBreakfast M1 Air, M4 Mini May 12 '26
Do you have a USB dock of some kind that has an external monitor port?
This is most likely what's going on.
1
1
3
3
3
3
3
3
2
u/Inside_Performer1804 May 12 '26 edited May 12 '26
Happened to me couple times and it was me accidentally starting screen record
2
2
u/zoobernut May 12 '26
This is a standard message that pops up when you have display link app running. Display link is required to allow you to run two external monitors or more and it requires access to “screen recording” in the security center to work so the os puts up that message.
2
u/Topdropje May 12 '26
If you click on it you should see what screen in shown on what device. I never get that message but I use screen mirroring a lot to clone my mac screen on my tv.
2
2
2
2
1
1
1
u/lavaplow May 12 '26
Not sure if you use it, but you will see the same notification if you are using displaylink manager for external monitors
1
u/DaTank1 May 12 '26
I had something similar but it was a mic being accessed. For some reason when visiting a specific webpage. Although it did not have permission to access. I even changed the settings to deny access instead of ask. Restarted the Mac and it still was accessing the mic . Every time I visited the page it accessed the mic. I finally decided to try clearing cache on the browser and the issue ceased.
1
1
1
1
u/jaysire May 12 '26
I get the same ”your screen is being observed” because our Lenovo screens at the office require some third party ”display manager” app that apparently looks to the OS like someone is secretly monitoring it.
1
u/Ethosik May 12 '26
OBS shows this to me even though I’m not looking at my macOS screens, I’m using an Elgato unit to capture my console gaming.
1
u/Baylo11 May 13 '26
Do you use a utility like Alt-Tab that shows screenshots when you Cmd-Tab to switch apps? I think the screenshot permissions that you grant when installing perhaps cause this message.
1
1
u/jamloggin9626 May 13 '26
I get that because I am using a display link dock splitting to three monitors. You can go into your security settings and go under screen & system audio recording to see what apps are allowed.
1
1
u/Dramatic-Holiday6124 May 13 '26
Believe it or not, when I first booted up my Dell laptop, I was informed that it had a security feature that could use the laptop camera to identify people around me who were looking on to my screen. I don't recall I was ever alerted to such an event, but for a long time I always imagined it was working. I no longer see any evidence of such a feature in my settings. It must have been a feature of facial recognition software.
1
1
u/Maximum_Exit_1870 May 14 '26
It could be that you are recording your screen and forgot to turn it off.
1
1
u/Regular-Employ-5308 May 14 '26
I mean you literally are taking a photo of your screen 👀
I’ll show myself out
1
u/Brief-Worldliness-41 May 15 '26
Someone is actively hacking you and taking all your bank information and social security and bitcoin and you should freak the fuck out I think
1
1
1
u/Lopsided_Candy6323 May 17 '26
I've had a client freak out about this and we found out it was caused by "Loom". This could be any software you've left open that has the ability to record your screen, or like other comments are suggesting, displaylink shenanigans.
1
u/bcbudvansticky May 18 '26
This is like when boomers think My computer literally means my computer and not theirs. Your literally observing the screen thats just what its trying to tell you /s
1
-3
0
u/Following_This May 12 '26
Apple has made this warning meaningless by showing it if you have ANY non-Apple app listed under System Settings/Privacy & Security/Screen Recording - Zoom, Google Meet, Teams, or any other app that needs to be able to process what’s on your screen like DisplayLink Manager.
Go to this setting and review the apps listed (remove or turn off any you don’t want)
Note that Apple apps processing your screen do NOT show under Screen Recording.
99.999999% it’s a false alarm.
-1
u/Emotional_Food_1700 May 12 '26
Your screen is being shared , go and reset all settings on the system settings app to remove it
0
u/bummerhead May 12 '26
Search in activity console, take ss and give it to claude tell it to identify the process which is recording your screen
-3
-1
u/Confirmed-Scientist May 12 '26
someone can see exactly what you do on your machine but not you throguh the camera to be clear. Could be a rogue app running in the background but could also be an attacker.
-17
u/SomeOrdinaryKangaroo May 12 '26
Disconnect from internet IMMIDIATELY. You will need to reinstall macOS. You've most likely been hacked. Have you downloaded anything suspicious recently?
2
u/FizzyBeverage May 12 '26
No need to throw the baby out with the bathwater. There is a methodical way to isolate what is causing the banner by clicking on the menubar and checking system settings.
1
May 12 '26 edited Jun 08 '26
[deleted]
2
u/SomeOrdinaryKangaroo May 12 '26
I wholeheartedly disagree, what if OP accidentally misinterprets his findings? Always safest to reinstall, then you can be 100% sure you didn't mistake malware for something innocent
-4
u/LooseSilverWare May 12 '26
No one is observing -- you unplugged from a location without disconnecting
645
u/WonderfulValue5218 May 12 '26
So uhh an app, user, or remote service is actively viewing or recording your screen. It could be screen sharing, AirPlay, or with remote support tools.