Solty

Claude Code found my sister's photos playing as a screensaver on a TV in a flat she moved out of a year ago. Then it found a keyboard on her phone that could send out everything she types. Same scan, same evening. She left that TV signed into her Google account. I plugged her iPhone into my laptop, pointed Claude Code at her App Privacy Report and screenshots of her Google device list, and asked it what didn't belong. What it pulled: device → Google TV, living room of her old student flat google account → hers last active → yesterday, 23:40 showing → Google Photos ambient mode, her whole library since → September 2025 The people living there now get her camera roll on the big screen every time the TV goes idle. Holidays, screenshots, the photo of her passport she took for a booking. No one broke in. The TV just kept doing what she set it up to do. The second one was worse: app → a free fonts keyboard she got for Instagram bios full access → ON can see → everything typed with it, except password fields contacted → 8 domains in 7 days, 6 of them ad and analytics networks last opened by her → never, it just runs as her keyboard She thought she installed a font. She installed a keyboard with full access. What we did that night: → signed the TV out of her Google account (Google app → her profile picture → Manage your Google Account → Security → Your devices → Sign out) → changed her Google password and turned on 2-step verification → deleted the keyboard (Settings → General → Keyboard → Keyboards → Edit) → checked every other keyboard for "Allow Full Access" and turned it off → set Photos access to "Limited" for every app that isn't the camera She went quiet for a minute. Then she asked me to check her laptop too. The prompt I used, paste it into Claude Code with the phone plugged in: "I'm checking my own family's iPhone and Google account. Read-only. From the App Privacy Report and these screenshots, list every device signed into her Google and Apple accounts with its last-active date, every third-party keyboard with Full Access, every app with Always location or full Photos access, and every domain each app contacted in the last 7 days. Flag anything she doesn't recognize. Then give me the fixes in order." Run it on every phone in your house. Bookmark this before you forget whose TV still has your Google account.

Claude Code found my mom's photos syncing to a stranger's iPad for 2 years. Then it found an app on her phone checking where she is every 15 minutes. Same scan, same evening. She gave her old iPad away in 2024. She never signed out. I plugged her iPhone into my MacBook, pointed Claude Code at the backup and her App Privacy Report, and had it walk us through Safety Check. What it pulled: device → iPad (9th gen) apple ID → hers last seen → 2 days ago syncing → iCloud Photos, iMessage, Safari tabs since → March 2024 Every photo she took, every message from our family chat, landed on that iPad. The kid who has it now could scroll her camera roll any evening. Nobody hacked anything. One forgotten sign-out did all of it. The second one was worse: app → a free QR scanner she used once at a restaurant location → "Always" photos → full library contacted → 11 domains in 7 days, 9 of them ad and data companies last opened by her → 14 months ago She forgot it existed. It didn't forget her. What we did that night: → removed the iPad from her Apple ID (Settings → her name → scroll to devices) → changed her Apple ID password and signed out every other session → deleted the QR app, then checked every app with "Always" location → set Photos access to "Limited" or "None" for everything that isn't the camera → turned on App Privacy Report so the next one shows up on its own My mom asked why I was on her phone for an hour. I told her it was an update. The prompt I used, paste it into Claude Code with the phone plugged in: "I'm checking my own family's iPhone. Read-only. From this backup and the App Privacy Report, list every device signed into this Apple ID with its last-seen date, every app with location set to Always, every app with full Photos access, and every domain each app contacted in the last 7 days. Flag anything not opened in 6+ months. Then give me the fixes in order." Run it on every phone in your house. Bookmark this before you forget whose iPad still has your Apple ID.

This is f*cking insane. Opus 5.5 just saved me. I connected my main phone to Claude and asked it to run a full analysis of my iPhone. Everything looked fine until it got to Instagram (it’s in the video). Someone had access to my iPhone through Instagram and could fully control it. And that phone has my cold wallet and all my passwords. I didn't panic. I opened Opus 5.5 and asked one thing: what do I lock first it didn't start with Instagram. it started with the money → wallet first. if your seed phrase ever touched this phone, notes, photos, screenshot, it's burned. new wallet, new seed, made on a clean device. move everything → then Instagram. Accounts Center → Password and security → Where you're logged in. kick every device you don't own. new password. 2FA on → then the thing most people miss: Settings → General → VPN & Device Management. a profile you didn't install there can control way more than any app → delete the app you didn't install. then Privacy & Security → Camera and Microphone. take access from anything you can't name → Apple ID → device list. remove what isn't yours. new password → then email and exchanges. starting with whatever was saved on the phone Glad I had Opus 5.5 check it in time. Everything ended well. Below is the prompt that saved me from losing everything. bookmark this.

This is f*cking creepy. I pointed Claude Code at our robot vacuum's app for one evening it doesn't just clean the flat. it draws it. every room, where the beds stand, which door is the bathroom, and it sends that drawing somewhere after every single clean here's where it goes and 5 fixes: what Claude found in one read-only pass over the app: > a full floor plan uploads after every run, not once > the map sits next to our Wi-Fi name, so it's not "a map" anymore, it's our address > the camera has a remote view mode that works from anywhere, behind a 4-digit PIN > 3 trackers keep pinging while the vacuum sleeps on the dock > the vacuum shares one Wi-Fi with my laptop, so the weakest device sees all the others and this isn't paranoia: - 2022: photos taken by Roomba test units, one of a woman on the toilet, ended up in private Facebook groups - 2024: strangers took over Ecovacs vacuums across the US, watched the live camera and shouted insults at families through the speaker how to fix yours tonight: 1. app settings → turn off remote camera, video call and voice features you don't use 2. delete saved maps you don't need 3. move the vacuum to a guest Wi-Fi, away from your phone and laptop 4. give the vacuum app a password you use nowhere else 5. Roborock or Dreame? Valetudo on GitHub runs the robot with zero cloud. the map never leaves your flat the prompt I used, paste it into Claude Code next to the app's APK: "Audit my own robot vacuum's Android app. Read-only. Decompile the APK and list every server it talks to, everything it uploads (maps, images, audio, Wi-Fi info), every tracker SDK and every permission. Show the file behind each finding. Then give me the 5 settings to change first." save this before the next clean. the article below runs the same check on phones and Macs, your vacuum is the one nobody checks

Opus 5.5 just found 40 trackers on my brother’s iPhone. One evening one of them didn't even have a real name… He’s 18. He thought his iPhone was clean. No weird apps, nothing from outside the App Store. I gave Opus 5.5 his iPhone’s privacy log and one prompt. 90 seconds later: → 118 apps → 755 different servers in 2 hours → 69 ad and tracking domains → 9 apps feeding them → 1 link that brought in 18 on its own that one link had: → 2 Russian tracking servers → one of them can record where you tap and scroll → Google's ad network → 4 ad servers with names I'd never seen → and one with a name like someone fell asleep on the keyboard 40 trackers. 2 hours. one phone none of it was hidden. every app came from the App Store that's the part that got me 3 apps set to Location → Never, app tracking off. took 3 minutes prompt below in reply ↓

Claude Code read my iPhone’s hidden privacy log. 9 apps were watching me. one of them I forgot I even had it started with the battery. dead by 3pm every day. warm in my pocket with the screen off I thought it was just old. it wasn’t there's a setting buried at the very bottom of Privacy & Security. App Privacy Report it quietly logs every time an app touches your: → location → photos → mic → camera → and every server it talks to almost nobody turns it on 12:03, I turned it on. put the phone in my pocket. lived a normal day 16:00, I opened it the list didn’t fit on the screen so I exported it, opened my laptop and gave Claude Code one prompt: replay my day and tell me who was watching it started printing. it didn’t stop for 2 minutes → 2,340 events in 4 hours → 9 apps checked where I was → 6 apps opened my photos → 47 different tracker servers → 3 apps were busiest while I wasn't even touching the phone then Claude printed the summary. one name was at the top of every list an old puzzle game I haven’t opened it since March. it’s not even on my home screen anymore. I forgot it existed today it asked for my location 48 times. every 5 minutes. on the bus, in the shop, at home it talked to 23 servers. 17 of them were ad trackers I’d never heard of at 14:37 it woke up on its own. phone in my pocket. screen off it knew where I was all day. I didn’t even know it was still there I deleted it. took back 14 permissions from 8 other apps. 5 minutes by 10pm my battery was at 40%. it used to be dead by 3 your check tonight takes 3 minutes: App Privacy Report → Settings → Privacy & Security → turn it on, look tomorrow location → nothing needs “Always” except maps and Find My photos → only your camera and gallery need “Full Access” mic and camera → if you can’t say why an app needs it, turn it off apps you forgot → if you haven’t opened it this month, it shouldn’t be watching you found something? screenshot the report first, then take the permission back save this. check your phone tonight. then check your mom’s the Opus 5.5 prompt I used ↓

Opus 5.5 is the best planner you'll ever pay for, and the most expensive typist. one model setting splits the job: /model opusplan plan mode → Opus 5.5 thinks execution → Sonnet 5.5 writes the code it switches by itself the moment you leave plan mode the whole loop: → Shift+Tab into plan mode → Opus 5.5 reads the repo, picks the approach, writes the plan → you approve the plan → Sonnet 5.5 builds it in the same session, same context the math on one long session (API prices, no cache): all on Opus 5.5: ~$5.60 opusplan: ~$3.08 Opus 5.5 costs $4 / $20 per million tokens, Sonnet 5.5 costs $2 / $10. about 90% of a session is execution, so most of your tokens drop to half price. on Pro/Max that means your limit lasts longer both phases get the 1M context window on the API. if yours doesn't, use /model opusplan[1m] the full tree > /model opusplan > plan mode: Opus 5.5 plans > you approve > execution: Sonnet 5.5 builds > stuck? Shift+Tab back into plan mode and Opus takes over again paste this into Claude Code ↓ "Switch me to /model opusplan. For this task: enter plan mode, read only what you need, and write a plan with the files to touch, the risks and a test checklist. Stop and wait for my approval. After I approve, implement it step by step and run the tests after each step." ↳ code.claude.com/docs/en/mode…