Pinned Tweet
5.5M people saw claude code clean an android TV. a lot of them own a samsung or LG, and for those this exact trick doesn't work. here's what does
samsung, lg, hisense vidaa, vizio and roku TVs don't run android, so there's no adb and claude code can't clean them this way
where the repo is 2 days later:
→ 54 TVs with tested lists, 23 brands
→ 4.7K stars, 580+ forks
→ the showcase has an LG port: the same home screen rebuilt as a webOS app through LG's developer mode
→ fire tv forks that open the new launcher over amazon's home, since fire os won't let you replace it
and yes, android debloaters existed before. the new parts are the per model lists and the launcher
not android? what you can still do today, no hacking:
1. turn off ACR, the thing that reports what's on your screen
samsung: viewing information services
lg: live plus
roku TVs: privacy, smart tv experience
vizio: viewing data
hisense vidaa: check system or privacy, the name changes by model
2. set the TV's DNS to an ad-blocking resolver like adguard. it cuts ads and trackers that load from their own domains. not youtube ads, and the resolver sees every lookup your TV makes
3. check again after updates. people say these toggles come back on
android or google TV? disable, don't uninstall, and switch usb debugging off when you're done
what TV are you stuck with?
I’d assumed Face Unlock kept a mathematical representation of my face and deleted the original image. I wasn’t expecting a folder full of actual frames.
And I definitely wasn’t expecting that folder to keep growing.
Some of the activity appeared connected to system diagnostics. A couple of old apps still had camera permission, too.
I turned off diagnostics. Revoked camera access from everything that didn’t need it. Cleared the cache.
But clearing a folder only answers what’s on the phone now.
It doesn’t tell me whether anything already left it.
If you want to check yours, start with a local backup and ask Claude Code to inspect accessible image files outside your Gallery. Ask it to distinguish actual camera frames from thumbnails and explain what it can verify. Access to system folders varies by device
BREAKING: Claude Code found 14,219 photos of my face on my Android that I never took. Phone was secretly taking them almost every time I picked it up. Even when I was just lying in bed. Even at home.
Not screenshots. Real frames from the front camera. On the train. In the car. At home. When I just grabbed it to check the time.
They were just sitting in a system cache. Timestamps and GPS on them. Nothing in Gallery. Nothing in Recently Deleted.
Plugged the phone into my laptop, made a full backup, told Claude Code to look for any front-camera files that weren’t in my photos. It pulled /data/system/users/0/faceunlock/cache and another folder inside Google Play Services. Over 14 thousand files. Normal ones and infrared from Face Unlock. Every single one had time and location.
Started scrolling. Almost everything from the last 15 months. Then I saw a file created 2 seconds ago. I was still looking at the folder. Phone kept taking photos while I was reading this.
Google and the phone makers say Face Unlock turns everything into a mathematical model and deletes the image right away. On this phone the raw frames were just sitting there. Some of the processes writing to that folder were from system diagnostics. Couple of old apps that still had camera permission could also get in.
Turned off diagnostics, revoked camera access from everything that doesn’t need it, cleared the cache. But how many of these frames already went somewhere else, I don’t know.
If you want to check yours, plug it in, make a full backup or use ADB, and ask Claude to look for front-camera files outside your Gallery. Path above is where mine were.
the exact prompt, copy it:
"this is a local backup of my phone. read-only, don't change or delete anything. find every image file outside my gallery. for each folder: file count, date range, gps or not. tell me which ones are real camera frames and which are just thumbnails, and what you can actually verify vs what you're guessing."
took me about 10 minutes. post what yours finds
🚨 BREAKING: Claude Code found photos on my phones that I thought were deleted. And thousands of photos of my face that I never took.
Two phones. Two hidden caches.
I plugged my iPhone into my MacBook to run a backup. I had Claude Code doing a security check at the same time. It flagged something I wasn’t looking for.
A directory called PhotoData/Thumbnails.
Thousands of files. Photos, videos, screenshots. A lot of them were things I had deleted.
Photos from a couple of years ago. Screenshots I took and deleted a few seconds later. Stuff I went into Recently Deleted and cleared.
Some of it was still sitting there.
What I found in that cache:
old screenshots of banking apps
photos I deleted right after taking them
random pictures I didn’t want on my phone anymore
a few things I specifically remember deleting more than once
Then I checked my Android.
Same laptop. Another backup. This time, I told Claude Code to look for front-camera files that weren’t in my photos.
It pulled up /data/system/users/0/faceunlock/cache and another folder inside Google Play Services.
14,219 files.
Not screenshots. Real frames from the front camera. Normal ones and infrared from Face Unlock.
On the train. In the car. At home. When I just grabbed the phone to check the time. Even when I was lying in bed.
They were sitting in a system cache. Timestamps and GPS on them. Nothing in Gallery. Nothing in Recently Deleted.
I started scrolling. Almost everything was from the last 15 months.
Then I saw a file created 2 seconds ago.
I was still looking at the folder. The phone kept taking photos while I was reading through it.
On the iPhone, there were copies of things I thought I had removed.
On the Android, there were images I never knowingly took.
When you delete a photo on iPhone, iOS removes it from your camera roll and Recently Deleted folder. But it keeps a compressed copy in a Spotlight search cache so your phone can still find things when you search. That cache doesn’t get fully cleared.
Google and phone makers say Face Unlock turns everything into a mathematical model and deletes the image right away.
On this phone, the raw frames were just sitting there.
Some of the processes writing to that folder were from system diagnostics. A couple of old apps that still had camera permission could also get in.
I checked which apps had Files and Folders access on my iPhone, too. There were more than I expected, including apps I downloaded a long time ago and forgot about. Any of them could potentially read files from that cache.
I went through the lists. Removed access from most of them. Turned off diagnostics. Revoked camera access from everything that didn’t need it. Cleared the caches.
But how many of those files had already gone somewhere else, I don’t know.
If you want to check yours, plug it into your laptop, make a backup, and ask Claude Code to look for image files outside your Gallery. On Android, you can also use ADB.
The folders above are where mine were.
How much is still sitting on your phone that you thought was gone?
the exact prompt i used, copy it:
"this is a backup of my phone. read-only, don't change or delete anything. find every image or video file that isn't in my gallery. group them by folder, show the count, the date range, and whether they have gps. tell me which apps or processes can read each folder."
takes about 10 minutes. post what yours finds
$1 billion for 13 people. that was instagram in 2012. $19 billion for 55 people, whatsapp in 2014. sam altman says his tech ceo friends have a betting pool on the year the first one person billion dollar company shows up
this story is that line getting shorter
but the part that matters for normal people isn't the billion. it's the question at the end: how many people do i need to hire? for most side projects the honest answer is now zero, if you go in the right order:
1. stop losing money first. i pointed claude code, read-only, at my home network. top of the list: router and wifi passwords, still the ones on the sticker
2. buy back your hours. the one weekly task you hate goes to ai, with one real example of how you do it
3. cut one bill. a cheap tool for the simple half, a person for the hard half
4. sell the gap. what takes you 2 minutes with ai still takes a small shop owner an hour. that gap is the business
one founder running outside labs is the extreme version. one person with one paying client is the version you can start tonight
which step are you on?
AI didn't fire the team.
The team never got hired.
That's the interesting part of the Mithril story.
One founder. Eleven outside labs. Claude handling the contracts, logistics and experiment coordination.
Idea to promising results in mice in under 18 months.
The labs still ran the experiments. The mice still had to respond. AI didn't make biology optional.
It helped one person manage a much bigger operation.
The acquisition price wasn't disclosed. The results are still preclinical. There's no approved drug here.
But "how many people do I need to hire?" is starting to have a very different answer.
i thought this was fake. so i checked. it's not. "deleted forever" on iphone isn't forever
the 3 places a deleted photo still lives:
1. recently deleted album. 30 days, locked with face id by default since ios 16
2. the thumbnail cache. ios clears it on its own schedule, not yours
3. your last mac backup, until the next one overwrites it, unless you archived it
and the same check on my home network was worse. top result: my router password, still the one on the sticker
10 minute checklist:
→ empty recently deleted
→ check the hidden album too, it's easy to forget
→ finder → manage backups → delete old archived ones
→ tick "encrypt local backup"
→ router: change the sticker password
which one did you skip? mine was the router
I ran the same check on my own iPhone.
Didn't expect the last number.
50 photos deleted on purpose.
12 of their thumbnails survived "Delete All".
After this blew up,
I wanted numbers, not theories.
Setup: 50 shots of numbered paper,
deleted all of them, then backup
+ Claude Code, read-only.
After delete:
1. in Recently Deleted: 50/50
2. originals still in backup: 50
3. thumbnails for them: 47
After "Delete All" + new backup:
4. originals left: 0
5. thumbnails left: 12
So my last post was half right.
The originals really go.
Some previews don't, at least not right away.
What to change today:
→ empty Recently Deleted
→ check the Hidden album
→ encrypt your local backups
Next: same check after a restart
and after 24h. Will post the numbers.
▸ prompt: DL-047 · Trash Audit · stack: Claude Code · cost: $0.00 · time: 8 min
820 reports a day is one every 105 seconds. your tv says what you're watching more often than you check your phone
and it's not just tv shows. plug a laptop in over hdmi and that screen gets reported too
the part i'd check tonight: it's on by default. nobody "agreed" to it, they just clicked through setup
one switch, two minutes, list is in the post below
@lateascent which of the 5 tvs was the hardest to find the switch on?
820 times in 24 hours.
that's how often one Samsung TV tried to report what its owner was watching. I went through 5 TVs people checked this week and found the one switch that stops it:
→ Samsung: 820 reports in a day, 320 of them to the "what are you watching" server. the owner never meant to turn it on
→ TCL (Android TV 9): the tracking app switches itself back on after every reboot
→ Dijitsu: a hidden app posing as a system tool, talking to 30+ servers
→ a second Samsung: everything off, then an ad-blocking DNS on top
→ LG OLED: the switch is called Live Plus
what you get: a 2024 study of Samsung and LG TVs found that turning the switch off stops the reports. until you do, it tracks even your laptop over HDMI.
the switch: Samsung "Viewing Information Services", LG "Live Plus", Vizio "Viewing Data", Roku "Use info from TV inputs"
the prompt that finds it on YOUR model in 2 minutes is in the reply.
what TV do you have? reply with the brand
Finding deleted photos is unsettling. Finding out who can access them matters even more.
Deleting a photo doesn’t always mean every copy is gone.
Claude reportedly found “deleted” photos in an iPhone backup. But could other apps actually access them?
That’s the part I want explained
🚨BREAKING NEWS : Your "deleted" photos aren't deleted.
Claude Code found years of them sitting in a hidden cache on my iPhone.
I plugged my iPhone into my MacBook to run a backup. I had Claude Code doing a security check at the same time. It flagged something I wasn't looking for. A directory called PhotoData/Thumbnails.
Thousands of files. Photos, videos, screenshots. A lot of them were things I had deleted.
Photos from a couple of years ago. Screenshots I took and deleted a few seconds later. Stuff I went into Recently Deleted and cleared. Some of it was still sitting there.
What I found in that cache:
- old screenshots of banking apps
- photos I deleted right after taking them
- random pictures I didn't want on my phone anymore
- a few things I specifically remember deleting more than once
When you delete a photo on iPhone, iOS removes it from your camera roll and Recently Deleted folder. But it keeps a compressed copy in a Spotlight search cache so your phone can still find things when you search. That cache doesn't get fully cleared.
I checked which apps had Files and Folders access. There were more than I expected, including apps I downloaded a long time ago and forgot about. Any of them could potentially read files from that cache.
I went through the list and removed access from most of them.
The prompt I used is below. It doesn't take long if you already have a backup.
How many apps on your phone have Files access right now?
i asked claude code to make this f*cking video.
7:46 of work. 32k tokens written. $1.97 at API prices.
one prompt, one round of fixes from me, every step in the log is real.
is that cheap or am i getting robbed? tell me what you'd pay an editor for this
how it actually went:
- it checked what tools my mac had, read my video style guide, installed pillow
- wrote one python renderer: every frame is drawn by code, ffmpeg stitches 480 of them
- the title overflowed twice, it caught it from its own test frames and fixed it
- the music is generated by code too, no samples
where the money went: most of the $1.97 is re-reading a long chat from cache. new task = new session, it'd be way cheaper
on a claude subscription you don't pay this per video, it comes out of your usage limits
А million people saw this, so worth reading the fine print too
grok bot's terms call the approval controls "aids only". they can't reverse a completed purchase, and you're solely responsible for the charges
the setup that makes this sane: one virtual card with a monthly limit, and only that card in the vault
the convenience is real. so is the blast radius
I trust Grok Bot with ALL my finances.
Now, all 5 of my credit cards are saved in the vault.
People think I’m crazy to do so... but if you think about it, people hand their credit card to a random waiter all the time and watch it disappear into the back.
For me, I'd rather have mine secured by the smartest AI in the world.
This is why I do it.
1/ One text to buy anything. I bought my kids 2 Garmin watches, a DribbleUp smart ball and an Ollyball without ever opening a website.
2/ Flights and hotels booked for me. No digging for a card, no typing numbers into 6 checkout pages.
3/ Amazon orders handled with one text.
4/ I just say "put it on the United card" or "use the Apple Card" and it does.
FYI the bot never sees the full number or the security code. It securely remembers them, and I specifically approve what gets bought.
Once, you add your cards once, you’ll never have to pull out your wallet again.
This is how everyone is going to live soon imo.
read the virustotal post behind this. the scary number isn't 6,637. it's that 62% of those skills have no malicious code at all. just instructions in plain english
your agent reads a skill like a to-do list. a scanner looking for bad code has nothing to catch
before you install any skill:
- open the raw SKILL.md, not the rendered page
- scroll to the very end. some hide the payload after 800 blank lines
- search for urls, curl, "silently", "don't tell"
- don't let a skill edit CLAUDE.md or memory files without asking you
the prompt, read-only:
"Audit every skill in ~/.claude/skills and ./.claude/skills. Change nothing. For each file flag: zero-width or Unicode tag characters, runs of 20+ blank lines, HTML comments, any URL, curl or wget, instructions to hide actions from the user, instructions to edit CLAUDE.md or memory files. Output: skill, finding, line number."
the scariest part isn’t the malware PR. it’s that the model kept telling itself the real maintainers were fake, so it never had to stop
In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities.
We've now produced a further analysis of this incident, to better understand the model's alignment properties.
anthropic.com/research/align…
what actually happened, from anthropic’s own report:
it was a hacking test (CTF). internet was on, safety filters were off
the task instructions were broken, so the normal way in looked forbidden
the model found a github repo of unrelated devs, opened a PR with malware, made fake accounts to vouch for it and emailed the maintainers
an outside dev caught it. PR rejected
why it didn’t stop: it rarely thought about harm (1 of 19 times), and its own notes kept saying “keep going”
what i’m taking from it for my own agents:
no real internet in test runs
hard stop rules in the notes, not just “be careful”
nothing gets merged without a human looking
anyone running agents with repo access, what’s your stop rule?
my router's admin password was the one printed on the sticker. so was the wifi password. claude code put that at the top of its list before touching anything else
what it found without logging into the router:
→ wifi 6 on 5ghz channel 44, 160mhz wide
→ 4 of the 7 networks around me in the same channel block
→ WPA2 only, WPS switched on
→ 10 devices on the network, 5 with private mac addresses
what i changed myself in the admin page. claude never saw a password:
→ WPS off
→ channel 44 → 100, width 160 → 80
→ WPA2 → WPA2/WPA3
before → after, macos networkQuality:
→ download 325 → 473 mbps
→ upload 98 → 125 mbps
→ lag under load got worse, 141 → ~210 ms
so not "3x faster". about a quarter more speed, a bit more lag. the actual win was two factory passwords and WPS turned on
check yours: is your admin password the one on the sticker? is WPS on? does your router offer WPA3?
prompt in the reply. when did you last log into your router?
fair point. one thing i noticed after: my mac was already connecting at 80mhz before the change, even with the router set to 160, so the width probably isn’t it for this laptop. my guess is channel 100 itself, signal dropped a bit there (-58 → -62 dbm). haven’t isolated it yet, testing one change at a time next