Claude Code found 4,812 private photos exfiltrated from an iPhone

goldtooth.exe@0xGoldTooth

I still don't know how to tell my wife… Claude Code just found 4,812 of her photos sent to a server in Hong Kong, including the private ones she took only for me.

Her iPhone sent every one of them while she was asleep next to me.

Our son's first steps, her passport, screenshots of our bank app, the photos from our hotel room last summer. Everything from the last three years was there.

It happened every night between 2 and 5 am with the screen off. Each photo had a time stamp and the same address, a server registered 40 days ago. She never saw a single sign of it, and the newest one left 6 minutes before I found it.

I plugged her iPhone into my MacBook and asked Claude Code to find every app that touched her photos while she slept. It pointed to a free cleaner she installed last spring after the "iPhone Storage Full" message and completely forgot about. 4,812 photos.

I started scrolling the list. Next to a few hundred of them I saw the album name: Hidden. She had locked that album with Face ID so nobody could open it.

Face ID only stops a person who picks up the phone, while an app with Full Access to Photos opens the Hidden album like any other folder. There is no green dot for that, like there is for the camera. The cleaner had that access from the day she installed it.

I deleted the app and switched every photo app to Limited Access. Who has already opened those photos, I don't know. In the morning I have to tell her.

Any app you ever allowed to see all your photos can do the same. If you want to check yours, plug your iPhone into a Mac, tap "Trust" and ask Claude Code to find every app with Full Access and show where each one sends data at night. The exact prompt I used is in the first comment.