Claude Code Reportedly Uncovers Vast Trove of Deleted Android Media
Anthropic's Claude Code AI reportedly found over 214,000 deleted media files, including sensitive personal images and a cryptocurrency seed phrase, hidden on an Android phone, raising privacy concerns.
A user has reported that Anthropic's Claude Code AI tool uncovered a staggering 214,856 deleted media files, including photos and videos, on a Google Pixel smartphone. The user, identified as Cooler (@coolerwave) on X, claims these files remained accessible in a hidden thumbnail folder long after they were permanently deleted and removed from the device's gallery trash and Android's media index.
According to the user's post, the discovery was made by connecting the Pixel to a MacBook and instructing Claude Code to search for residual media. The AI reportedly identified files within the DCIM/.thumbnails directory, a common location for cached image previews. Cooler stated that most of the recovered files were compressed versions, but several were close to their original size, allegedly including passport images, bank screenshots, private photographs, and a cryptocurrency seed phrase.
This claim, if verified, could have significant implications for user privacy on Android devices. The user asserted that "any app with storage access can read them," suggesting a broad vulnerability. However, the report from Cyber Security News notes that the findings are unverified and cannot be definitively classified as an Android security flaw. The distinction between a cached thumbnail and an original, recoverable file is crucial, as Android systems commonly generate previews to speed up gallery loading.
Furthermore, the sheer volume of 214,856 files requires careful contextualization. A thorough review would need to differentiate between unique images, repeated previews, database entries, and other cached data. Without such a breakdown, the headline figure should be treated as the user's reported result rather than a confirmed total of recoverable original media.
The incident follows a previous report where Claude AI identified a suspected hidden cryptocurrency miner on a Mac, indicating a growing interest in AI's capabilities for security-related investigations, though individual findings still necessitate independent validation.
The assertion that "any app with storage access can read every deleted image" is likely an oversimplification. Android's scoped storage architecture, particularly on versions Android 11 and higher, imposes restrictions on file access. The actual level of access an app has depends on its target Android version, the specific permissions granted by the user, and the location of the files. Android 14's introduction of selected photo access further refines user control over media sharing.
While the broad "MANAGE_EXTERNAL_STORAGE" permission can grant extensive access to shared storage, it does not typically allow access to other apps' protected directories. Ordinary photo permissions and "All files access" are not equivalent, and granting excessive permissions can indeed create security risks, as seen in past instances of Android spyware that leveraged such privileges for surveillance and data theft.
Users are advised to regularly review app permissions, especially those related to storage and photo access, and revoke any permissions that are not essential for an app's functionality. Where available, utilizing features like selected-photo sharing can provide a more granular and secure way to grant access to media.