AI tool Claude Code is at the center of new privacy concerns after a user reported it located over 214,000 files linked to deleted photos and videos on a Google Pixel phone. The discovery, made by Cooler (@coolerwave), alleges that deleted images remain in a hidden thumbnail folder even after users believe they’ve permanently deleted them.
What Was Discovered
The user says Claude Code identified a folder called DCIM/.thumbnails, where many files survive as compressed previews—some reportedly close to original file sizes. The data allegedly includes very personal content, from passport images and bank screenshots to intimate photos and even a cryptocurrency seed phrase. Importantly, many of these files were not visible in the phone’s gallery trash or Android’s MediaStore index.
What It Doesn’t Prove—Yet
There are a number of caveats. First, it’s unclear whether all 214,856 files are unique deleted items; cached previews or duplicates might be inflating the count. Finding a thumbnail doesn’t necessarily mean the original photo or video can be recovered. Also, nothing confirms this is an Android system flaw rather than a local storage behavior specific to Cooler’s setup.
Permissions, Android Versions & Privacy Rules
Android’s scoped storage rules—which take effect in Android 11 and later—restrict what apps can access in shared storage. Apps may need special permissions like MANAGE_EXTERNAL_STORAGE to broadly access storage, but even that doesn’t grant access to all protected directories. Android 14’s “selected photo access” also gives users more control, letting them share specific images rather than their full library.
What Users Can Do Now
Users should review app permissions, especially those granting wide file system access. Where supported, enabling selective sharing for photos is a more secure option than giving blanket storage permissions. For those using cloud backups, it’s worth understanding how “free up space” features manage local vs. cloud copies—deleted files may still linger locally even after removal.
This case isn’t the first time Claude Code has touched off controversy. Earlier reports said the tool flagged a suspected concealed cryptocurrency miner on a Mac. While such AI-enabled examinations draw attention, their findings often need independent analysis to verify claims.
Why this matters: This situation highlights a gap between how users think deletion works and how data actually persists due to system design and storage behavior. It’s a reminder that file previews and thumbnails aren’t always transient. Going forward, clearer user tools and transparency in Android’s storage handling could make a big difference.
