Android Secretly Stored Over 14,000 Face Unlock Photos
Claude Code Allegedly Uncovers 14,219 Hidden Face Unlock Photos on Android Smartphone
An X user claims to have discovered 14,219 photos of their face stored in hidden Android system directories after using Claude Code to analyze a smartphone backup. According to the report, the device captured images through its front-facing camera for about 15 months without the user's knowledge.
The images reportedly included photos taken at home, while traveling, lying in bed, or briefly picking up the phone to check the time. None appeared in the Gallery or Recently Deleted folders.
The user connected the Android device to a laptop, created a backup, and instructed Claude Code to search for front-camera images stored outside the standard photo library.
The investigation allegedly identified thousands of files in two locations: a Face Unlock cache directory and another directory associated with Google Play Services.
One reported path was:
/data/system/users/0/faceunlock/cache
According to the user, the files included both standard camera images and infrared frames associated with facial recognition. The user also claimed each image contained timestamps and GPS location metadata.
While reviewing the files, the user reportedly noticed an image created only two seconds earlier. This suggested the device was continuing to capture and store camera frames during the investigation.
Android's facial authentication systems typically process camera data to generate biometric representations used for identity verification. Depending on the device and implementation, biometric processing occurs in protected hardware or isolated software environments. Raw facial images are generally not intended to remain accessible as ordinary files after authentication.
The reported behavior therefore raises questions about how the device handled biometric images, whether diagnostic components retained camera frames, and which processes could access the stored data.
The user also claimed some processes writing to the directories were associated with system diagnostics, while several older applications still possessed camera permissions. The report did not identify the smartphone manufacturer, Android version, affected applications, or the specific processes responsible for creating the files.
Following the discovery, the user disabled diagnostic features, revoked unnecessary camera permissions, and cleared the reported cache. The user asked whether any of the stored images had been transmitted to external services.
The allegations have not been independently verified. No forensic evidence, device logs, or reproducible technical findings have been published to confirm the reported behavior. The specified /data/system/ directory is normally protected by Android's security model and is not accessible through standard ADB commands or ordinary device backups without elevated privileges.
The incident remains an unconfirmed user report, not evidence of a widespread Android or Google Play Services privacy issue.