Cybersecurity engineer specialised in detecting threats and preventing attacks. Currently working as a staff in fintech/blockchain
London, England
Joined September 2018
- Tweets395
- Following918
- Followers813
- Likes780
Pinned Tweet
Ransomware we've recently analysed uses the following command to pop your machine into Safe Mode before performing encryption
C:\Windows\System32\bcdedit.exe /set safeboot network
Why? Because your EDR/AV might not be allowed to run in Windows Safe Mode
1/2
Welcome to digital forensics
Claude Code found 145,763 photos I permanently deleted from my iPhone.
Three years of deleted photos and videos still sitting in a hidden cache. Any app with file access can read them.
I plugged my iPhone into my MacBook to run a backup. Claude Code was doing the security audit from my last post and flagged a directory I wasn't even looking for.
PhotoData/Thumbnails. Over 146,000 files. Photos, videos, screenshots. Every single one was something I deleted.
Photos from 2023, 2024 and 2025. The ones I deleted the second after taking them. The ones I cleared from Recently Deleted. The ones I deleted three separate times because I wanted to be sure they were gone. All still there.
Passport photo I took for a visa application in 2023.
Screenshots of my bank app with full account numbers visible.
Private photos I sent someone and immediately deleted after a breakup.
Screenshot of my crypto seed phrase I took temporarily in 2022.
Photo of my ID and credit card I took to remember the numbers and deleted 5 seconds later.
Screenshots of my ex's private Instagram stories I saved and permanently deleted in 2023.
Some were full resolution. All organized by date going back to 2021.
When you delete a photo on iPhone, iOS removes it from your camera roll and Recently Deleted. It keeps a compressed copy in a Spotlight search index cache so your phone can find things when you search. Apple never clears it. Not after 30 days. Not after a year. Never.
They told you it was permanently deleted. It wasn't.
I checked which apps on my phone had Files and Folders access. 23 apps. Weather apps. QR code scanners. PDF readers. A flashlight app I downloaded in 2022. Any one of them could have been reading every photo I ever deleted this entire time.
Went from 23 apps to 3 in about two minutes.
Full step by step below. Takes 2 minutes. Save it so you don't lose it and send it to anyone with an iPhone.
Readers added context they thought people might want to know
The author is posting AI-generated engagement bait text with various random claims of deleted photos or videos on a daily basis.
1. x.com/coolerwave/sta… - "BREAKING: Claude Code found 12,847 photos of my face on my iPhone
2. x.com/coolerwave/sta… - "Claude Code found 214,856 photos and videos I permanently deleted
Starting to see event more prompt injection in the wild..
To compensate for letting my agents run freely on my machine I am using docker sbx to sandbox Claude Code
Here's how I set it up 🧵
Step 3 is the network, super important
The preset allows wildcards like **.amazonaws.com and **.googleapis.com.. but rogue agents could still use those to upload your code to any public bucket.
sbx policy deny network --sandbox myproj \
"**.googleapis.com" "**.amazonaws.com"
Open hosts one at a time, only when a task needs them:
sbx policy allow network --sandbox myproj docs.example.com
treat the allowlist like a firewall
Wild this was only a year ago. Say what you want about Anthropic but he was right
businessinsider.com/anthropi…
"Luna Reserve" is a nice touch added by Codex.
If, like me, you have burned through your allowance within 2 hours on Saturday morning, you can use Luna for simple tasks until your allowance resets.
Jev appears to have a multiple cybersecurity use cases
I will be testing each of these out against frontier LLMs
Firstly - the obvious one to me - security threat alert triage...
This allows us to scale up the volume of security telemetry we feed to our agentic pipelines.
Big win.