Claude Code 发现安卓手机偷拍并缓存了 14,219 张用户面部照片
英文标题：🔶 Claude Code found 14,219 photos of my face on my Android that I never took
一名开发者在使用 Anthropic 的 Claude Code 工具审查安卓手机备份数据时，在底层面部解锁及 Google Play 服务缓存路径中发现了 14,219 张未主动拍摄的前置摄像头和红外照片。这些照片完整记录了过去 15 个月用户拿起手机时的面部画面，并附带时间戳和 GPS 定位，与手机厂商“面部数据仅转为数学模型且立即销毁原始图像”的承诺严重不符。这一发现揭示了移动操作系统在硬件级生物识别安全及系统缓存管理上的重大隐私隐患，同时也凸显了具备系统分析能力的 AI Agent 在终端安全与隐私审计场景中的实用价值。
1.9 KB
6.0 KB
61.5 KB
2.9 KB
31.4 KB
2.3 KB
7.0 KB
64.6 KB
中文
突发： Claude Code 在我的安卓手机上发现了 14,219 张我从未主动拍摄过的面部照片。几乎每次我拿起手机时，它都在暗中拍照——无论是我正躺在床上，还是在家里、在火车上、在车内，或者只是拿起手机看一眼时间。这些不是屏幕截图，而是来自前置摄像头的真实图像画面。
它们就静静地存放在系统缓存中，附带有时间戳和 GPS 定位信息。相册里完全看不到，最近删除列表中也没有。我把手机连接到笔记本电脑上做了一个完整备份，然后让 Claude Code 查找不在相册里的所有前置摄像头文件。它定位到了 /data/system/users/0/faceunlock/cache 以及 Google Play Services 内部的另一个文件夹。
总计超过 1.4 万个文件，包含了普通照片以及来自面部解锁（Face Unlock）的红外图像。每一张都带有时间和地理位置。我开始往后翻看，几乎涵盖了过去 15 个月的所有记录。紧接着我看到一个 2 秒前刚刚生成的文件——当时我正看着该文件夹，手机在我阅读这些内容的同时仍然在持续拍照。
Google 和手机厂商宣称面部解锁会将所有内容转换为数学模型，并立即删除原始图像。但在这台手机上，未经处理的原始画面就一直存放在那里。向该文件夹写入数据的部分进程来自于系统诊断程序；另外几个仍保有相机权限的老应用也能访问该目录。目前我已经关闭了诊断程序，撤销了所有非必要应用的相机权限，并清理了缓存。但这些画面中究竟有多少已经被传输到了别处，我不得而知。
如果你也想检查自己的手机，可以将其连接到电脑，进行完整备份或使用 ADB，然后让 Claude 检索相册目录之外的前置摄像头文件。上面的路径就是我在自己手机上发现它们的地方。
English / 原文
BREAKING: Claude Code found 14,219 photos of my face on my Android that I never took. Phone was secretly taking them almost every time I picked it up. Even when I was just lying in bed. Even at home. Not screenshots. Real frames from the front camera. On the train. In the car. At home. When I just grabbed it to check the time. They were just sitting in a system cache. Timestamps and GPS on them. Nothing in Gallery. Nothing in Recently Deleted. Plugged the phone into my laptop, made a full backup, told Claude Code to look for any front-camera files that weren’t in my photos. It pulled /data/system/users/0/faceunlock/cache and another folder inside Google Play Services. Over 14 thousand files. Normal ones and infrared from Face Unlock. Every single one had time and location. Started scrolling. Almost everything from the last 15 months. Then I saw a file created 2 seconds ago. I was still looking at the folder. Phone kept taking photos while I was reading this. Google and the phone makers say Face Unlock turns everything into a mathematical model and deletes the image right away. On this phone the raw frames were just sitting there. Some of the processes writing to that folder were from system diagnostics. Couple of old apps that still had camera permission could also get in. Turned off diagnostics, revoked camera access from everything that doesn’t need it, cleared the cache. But how many of these frames already went somewhere else, I don’t know. If you want to check yours, plug it in, make a full backup or use ADB, and ask Claude to look for front-camera files outside your Gallery. Path above is where mine were.