Anthropic’s Claude AI has drawn attention to smartphone privacy after an X user claimed that Claude Code uncovered thousands of facial images and previously deleted photos hidden outside the phone’s regular photo library. However, the claims have not been independently verified, and the available evidence does not establish that smartphones are secretly photographing users or exposing their private images.
The allegations were shared by an X user known as Cooler, who said they connected an Android phone to a laptop, created a backup, and asked Claude Code to search for front-camera images outside the Gallery and Recently Deleted folders. According to the user, the scan identified 14,219 front-camera and infrared image files allegedly associated with the phone’s face-unlock system.
Cooler claimed that the files covered approximately 15 months and included timestamps and location information. The user also alleged that new files continued appearing while they inspected the results, raising concerns about whether the phone was capturing and storing images without their knowledge.
Claude Code found 145,763 photos I permanently deleted from my iPhone. Three years of deleted photos and videos still sitting in a hidden cache. Any app with file access can read them. I plugged my iPhone into my MacBook to run a backup. Claude Code was doing the security audit from my last post and flagged a directory I wasn’t even looking for. PhotoData/Thumbnails. Over 146,000 files. Photos, videos, screenshots. Every single one was something I deleted. Photos from 2023, 2024 and 2025. The ones I deleted the second after taking them. The ones I cleared from Recently Deleted. The ones I deleted three separate times because I wanted to be sure they were gone. All still there. Passport photo I took for a visa application in 2023. Screenshots of my bank app with full account numbers visible. Private photos I sent someone and immediately deleted after a breakup. Screenshot of my crypto seed phrase I took temporarily in 2022. Photo of my ID and credit card I took to remember the numbers and deleted 5 seconds later. Screenshots of my ex’s private Instagram stories I saved and permanently deleted in 2023. Some were full resolution. All organized by date going back to 2021. When you delete a photo on iPhone, iOS removes it from your camera roll and Recently Deleted. It keeps a compressed copy in a Spotlight search index cache so your phone can find things when you search. Apple never clears it. Not after 30 days. Not after a year. Never. They told you it was permanently deleted. It wasn’t. I checked which apps on my phone had Files and Folders access. 23 apps. Weather apps. QR code scanners. PDF readers. A flashlight app I downloaded in 2022. Any one of them could have been reading every photo I ever deleted this entire time. Went from 23 apps to 3 in about two minutes. Full step by step below. Takes 2 minutes. Save it so you don’t lose it and send it to anyone with an iPhone.
— Cooler (@coolerwave) October 24, 2026
According to the post, some files were located in /data/system/users/0/faceunlock/cache and another directory associated with Google Play Services. Cooler said they subsequently disabled diagnostics, revoked unnecessary camera permissions, and cleared the cache. However, the posts do not independently establish the origin of the files or whether any images were transmitted outside the device.
The claims have raised questions about Google’s explanation of its facial recognition technology. According to Google’s official Pixel Face Unlock documentation, images used to create a face model are not stored as ordinary photographs. The face model is securely stored on the device and does not leave it, while processing takes place locally.
The reported files would therefore require further technical investigation to determine whether they were genuine facial images, temporary processing data, diagnostic files, or something else. Finding files in a directory associated with facial recognition does not, by itself, prove that the phone routinely saves photographs of its owner.
The same user made a separate claim involving an iPhone backup. Cooler alleged that Claude Code identified more than 145,000 images and videos that had been deleted over several years but remained in hidden storage locations.
The reported files allegedly included photographs, screenshots, and sensitive information such as passport images, banking details, identity documents, credit card information, and a cryptocurrency recovery phrase. According to the user, some of the files dated back to 2021 and were not visible in the regular Photos library or Recently Deleted album.
The iPhone allegation has also attracted scrutiny because cached thumbnails and original photographs are not necessarily the same thing. Smartphones and applications can retain smaller image previews, temporary files, or indexed information to support search and improve performance. Finding such files does not automatically mean that complete, permanently deleted photographs can be recovered or accessed by every application.
Apple maintains that Face ID uses protected facial data for authentication. Its security architecture is designed to keep sensitive biometric information isolated from ordinary applications. The reported findings would need to be examined against Apple’s documentation and the specific device’s file structure before any conclusions could be drawn about a potential vulnerability.
There are also questions about how the Android files were accessed. Cybernews researchers noted that an ordinary Android application should not normally be able to browse protected system directories without elevated privileges or a modified device configuration. Android’s security documentation explains how application sandboxing and other protections restrict access between apps and system resources.
If the reported files were genuine, investigators would need to establish whether the device had been modified, whether the files were created by legitimate system processes, and whether other applications could actually access them. The available posts do not provide enough independently verified evidence to answer those questions.
Claude Code can help analyse files and search through accessible data, but its involvement does not independently validate the results. Confirming the allegations would require a forensic examination of the original files, their metadata, the device’s operating system, and relevant system logs.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
For now, the claims remain unverified and should not be treated as proof that Android phones or iPhones routinely capture and secretly store thousands of facial photographs. The reports nevertheless highlight an important privacy issue: cached files and leftover data can sometimes remain on a device after users believe they have deleted them, making it important to understand how smartphone storage and application permissions work.
