Claude finds Android phone allegedly took thousands of secret photos

Claude uncovered thousands of supposedly deleted photos and hidden facial images on smartphones.

A series of posts by an X user going by the handle Cooler alleges that Anthropic’s Claude uncovered thousands of image files secretly stored on their device that were missing from the phone’s regular photo library.

Cooler said they connected their phone to a laptop, created a backup, and instructed Claude Code to search for front-camera images outside the Gallery and Recently Deleted folders.

The results showed that the Android phone contained 14,219 front-camera and infrared images associated with facial unlocking.

The files spanned approximately 15 months and included timestamps and location information.

“Then I saw a file created 2 seconds ago. I was still looking at the folder. Phone kept taking photos while I was reading this,” Cooler explains.

According to the claims, the AI tool found files in the directory /data/system/users/0/faceunlock/cache, as well as in another location associated with Google Play Services.

“Turned off diagnostics, revoked camera access from everything that doesn’t need it, cleared the cache. But how many of these frames already went somewhere else, I don’t know,” Cooler said.

The alleged findings contradict Google's official position.

“When you use Face Unlock, face images are used to update your face model so that, over time, your device can recognize you in more scenarios,” Google states on its support website.

“The face images used to create your face model aren't stored, but the face model is stored securely on your device and never leaves the device. All processing occurs securely on your device.”

Claude found deleted iPhone photos still stored on the device

In another post, Cooler states that Claude found an iPhone backup containing more than 145,000 images and videos deleted over several years.

The files included photographs and screenshots dating back to 2021, some of which the user said had been deleted immediately after being taken.

Among the stored images were a passport photograph prepared for a visa application, screenshots of a banking app displaying account numbers, a photograph of an identity document and credit card, and a cryptocurrency seed phrase.

“Three years of deleted photos and videos still sitting in a hidden cache. Any app with file access can read them,” Cooler said.

According to the post, the files appeared in a directory identified as PhotoData/Thumbnails, rather than in the normal Photos library or Recently Deleted album.

Apple's documentation confirms that Spotlight maintains a local search index for information stored on a device, including photos and other content. It does not mention the deleted photos.

However, users have repeatedly reported this issue on Apple's own support forums, describing deleted selfies reappearing as thumbnails under Photos' "Places" view and deleted Messages images surfacing in Spotlight search results long after being removed.

A modified device?

Cybernews researchers stated that an ordinary Android phone would not allow a user to access the protected system folders described in the post without the device being significantly modified.

Researchers said the device could have been bought second-hand or come from a suspicious manufacturer that had made unusual changes to its operating system.

“If it was just a bug, non-system apps couldn't access these files,” the researchers explained, meaning the discovery would not necessarily translate into a wider privacy risk. Android's security documentation confirms that applications are normally sandboxed, meaning the device would have to be deliberately modified to capture and export the images.

While the scenario of a phone capturing and storing these images is technically possible, it presents practical challenges.

Storing over 14,000 additional photos on the device would consume a significant portion of its storage capacity.

Additionally, the video provided by the X user shows a system scan, but does not explicitly show a scan for photos on the phone. Consequently, the validity of the claims remains unverified.