Claude Code finds sister's photos on old TV

Solty@0xSolty

Claude Code found my sister's photos playing as a screensaver on a TV in a flat she moved out of a year ago. Then it found a keyboard on her phone that could send out everything she types. Same scan, same evening.

She left that TV signed into her Google account.

I plugged her iPhone into my laptop, pointed Claude Code at her App Privacy Report and screenshots of her Google device list, and asked it what didn't belong.

What it pulled:

device → Google TV, living room of her old student flat
google account → hers
last active → yesterday, 23:40
showing → Google Photos ambient mode, her whole library
since → September 2025

The people living there now get her camera roll on the big screen every time the TV goes idle. Holidays, screenshots, the photo of her passport she took for a booking. No one broke in. The TV just kept doing what she set it up to do.

The second one was worse:

app → a free fonts keyboard she got for Instagram bios
full access → ON
can see → everything typed with it, except password fields
contacted → 8 domains in 7 days, 6 of them ad and analytics networks
last opened by her → never, it just runs as her keyboard

She thought she installed a font. She installed a keyboard with full access.

What we did that night:

→ signed the TV out of her Google account (Google app → her profile picture → Manage your Google Account → Security → Your devices → Sign out)
→ changed her Google password and turned on 2-step verification
→ deleted the keyboard (Settings → General → Keyboard → Keyboards → Edit)
→ checked every other keyboard for "Allow Full Access" and turned it off
→ set Photos access to "Limited" for every app that isn't the camera

She went quiet for a minute. Then she asked me to check her laptop too.

The prompt I used, paste it into Claude Code with the phone plugged in:

"I'm checking my own family's iPhone and Google account. Read-only. From the App Privacy Report and these screenshots, list every device signed into her Google and Apple accounts with its last-active date, every third-party keyboard with Full Access, every app with Always location or full Photos access, and every domain each app contacted in the last 7 days. Flag anything she doesn't recognize. Then give me the fixes in order."

Run it on every phone in your house. Bookmark this before you forget whose TV still has your Google account.