Claude Code audit reportedly found 145,000 deleted iPhone photos in a hidden cache

What happened

On October 24, a developer posting as @coolerwave on X described an unexpected find during a routine chore: they had connected an iPhone to a MacBook to run a backup while Claude Code, Anthropic's command-line AI assistant, continued a security audit they had started in an earlier post. The tool flagged a directory they had not asked it to inspect, called PhotoData/Thumbnails. According to the post, it held 145,763 photos — described as more than 146,000 files once videos and screenshots were counted — all of which the user says had been deleted from the device.

The cache was organized by date and stretched back to 2021, with material from 2023 through 2025. Some entries were full-resolution rather than small thumbnails. The user's inventory of what they found included a passport photo taken for a 2023 visa application, banking app screenshots showing full account numbers, a 2022 screenshot of a crypto wallet seed phrase, a picture of an ID and credit card kept briefly as a memory aid, and intimate photos deleted moments after being sent. The post circulated widely after reaching the Hacker News front page.

Why the files survived

In the user's telling, deletion on iOS is a two-step affair: a photo leaves the camera roll, then leaves the Recently Deleted album. Neither step, they claim, touches a compressed copy kept in a cache that Spotlight, the system-wide search feature, uses to return photo results. The user asserts that Apple never purges this cache — not after the 30-day Recently Deleted window, and not ever.

That mechanism is the poster's own explanation, offered in a social media post without supporting logs, documentation, or code, and it has not been independently confirmed. The post is also ambiguous about where the flagged directory actually sits — in the phone's own storage or in the backup data the Mac was writing — though the user's follow-up claims about apps reading it imply the former.

The app-access claim

The consequence the user drew is that any app holding Files and Folders access could have read the entire history of deleted photos. They counted 23 apps with that permission, including weather apps, QR-code scanners, PDF readers and a flashlight app installed back in 2022, and revoked all but three — a cleanup they say took roughly two minutes. The full post includes a step-by-step walkthrough, and the user urged readers to pass it along to other iPhone owners.

Whether third-party iOS apps can genuinely traverse into a system photo-index directory is an open question. iOS sandboxing is designed to keep apps out of paths the user has not explicitly granted, so the claim that any app with file access could read the cache deserves scrutiny before it is treated as established fact.

Why it matters

Even as an unverified single account, the story lands on three sensitive nerves. First, deletion is a promise an operating system makes to its user, and material like seed phrases, identity documents and private photos outliving that promise by years would be a genuine privacy failure if confirmed. Second, caches like this do not stay put: whatever the photo index contains also travels into device backups, extending the exposure from the phone to the computer. Third, the cheap mitigation is available right now — iPhone users can open privacy settings, review which apps hold Files and Folders access, and cut the list down, which is the one concrete step the poster recommends.

There is also a quieter subplot for a technical audience: the finding did not come out of a forensic lab. It surfaced because a developer pointed an AI coding assistant at a security audit and the agent noticed a directory nobody was looking for. If the report holds up, it is an early, concrete example of agentic tooling catching a privacy problem that years of ordinary manual use never revealed.