Claude Code found my mom's photos syncing to a stranger's iPad for 2 years. Then it found an app on her phone checking where she is every 15 minutes. Same scan, same evening. She gave her old iPad away in 2024. She never signed out. I plugged her iPhone into my MacBook, pointed Claude Code at the backup and her App Privacy Report, and had it walk us through Safety Check. What it pulled: device → iPad (9th gen) apple ID → hers last seen → 2 days ago syncing → iCloud Photos, iMessage, Safari tabs since → March 2024 Every photo she took, every message from our family chat, landed on that iPad. The kid who has it now could scroll her camera roll any evening. Nobody hacked anything. One forgotten sign-out did all of it. The second one was worse: app → a free QR scanner she used once at a restaurant location → "Always" photos → full library contacted → 11 domains in 7 days, 9 of them ad and data companies last opened by her → 14 months ago She forgot it existed. It didn't forget her. What we did that night: → removed the iPad from her Apple ID (Settings → her name → scroll to devices) → changed her Apple ID password and signed out every other session → deleted the QR app, then checked every app with "Always" location → set Photos access to "Limited" or "None" for everything that isn't the camera → turned on App Privacy Report so the next one shows up on its own My mom asked why I was on her phone for an hour. I told her it was an update. The prompt I used, paste it into Claude Code with the phone plugged in: "I'm checking my own family's iPhone. Read-only. From this backup and the App Privacy Report, list every device signed into this Apple ID with its last-seen date, every app with location set to Always, every app with full Photos access, and every domain each app contacted in the last 7 days. Flag anything not opened in 6+ months. Then give me the fixes in order." Run it on every phone in your house. Bookmark this before you forget whose iPad still has your Apple ID.

This is f*cking insane. Opus 5.5 just saved me. I connected my main phone to Claude and asked it to run a full analysis of my iPhone. Everything looked fine until it got to Instagram (it’s in the video). Someone had access to my iPhone through Instagram and could fully control it. And that phone has my cold wallet and all my passwords. I didn't panic. I opened Opus 5.5 and asked one thing: what do I lock first it didn't start with Instagram. it started with the money → wallet first. if your seed phrase ever touched this phone, notes, photos, screenshot, it's burned. new wallet, new seed, made on a clean device. move everything → then Instagram. Accounts Center → Password and security → Where you're logged in. kick every device you don't own. new password. 2FA on → then the thing most people miss: Settings → General → VPN & Device Management. a profile you didn't install there can control way more than any app → delete the app you didn't install. then Privacy & Security → Camera and Microphone. take access from anything you can't name → Apple ID → device list. remove what isn't yours. new password → then email and exchanges. starting with whatever was saved on the phone Glad I had Opus 5.5 check it in time. Everything ended well. Below is the prompt that saved me from losing everything. bookmark this.

This is f*cking creepy. I pointed Claude Code at our robot vacuum's app for one evening it doesn't just clean the flat. it draws it. every room, where the beds stand, which door is the bathroom, and it sends that drawing somewhere after every single clean here's where it goes and 5 fixes: what Claude found in one read-only pass over the app: > a full floor plan uploads after every run, not once > the map sits next to our Wi-Fi name, so it's not "a map" anymore, it's our address > the camera has a remote view mode that works from anywhere, behind a 4-digit PIN > 3 trackers keep pinging while the vacuum sleeps on the dock > the vacuum shares one Wi-Fi with my laptop, so the weakest device sees all the others and this isn't paranoia: - 2022: photos taken by Roomba test units, one of a woman on the toilet, ended up in private Facebook groups - 2024: strangers took over Ecovacs vacuums across the US, watched the live camera and shouted insults at families through the speaker how to fix yours tonight: 1. app settings → turn off remote camera, video call and voice features you don't use 2. delete saved maps you don't need 3. move the vacuum to a guest Wi-Fi, away from your phone and laptop 4. give the vacuum app a password you use nowhere else 5. Roborock or Dreame? Valetudo on GitHub runs the robot with zero cloud. the map never leaves your flat the prompt I used, paste it into Claude Code next to the app's APK: "Audit my own robot vacuum's Android app. Read-only. Decompile the APK and list every server it talks to, everything it uploads (maps, images, audio, Wi-Fi info), every tracker SDK and every permission. Show the file behind each finding. Then give me the 5 settings to change first." save this before the next clean. the article below runs the same check on phones and Macs, your vacuum is the one nobody checks

Opus 5.5 just found 40 trackers on my brother’s iPhone. One evening one of them didn't even have a real name… He’s 18. He thought his iPhone was clean. No weird apps, nothing from outside the App Store. I gave Opus 5.5 his iPhone’s privacy log and one prompt. 90 seconds later: → 118 apps → 755 different servers in 2 hours → 69 ad and tracking domains → 9 apps feeding them → 1 link that brought in 18 on its own that one link had: → 2 Russian tracking servers → one of them can record where you tap and scroll → Google's ad network → 4 ad servers with names I'd never seen → and one with a name like someone fell asleep on the keyboard 40 trackers. 2 hours. one phone none of it was hidden. every app came from the App Store that's the part that got me 3 apps set to Location → Never, app tracking off. took 3 minutes prompt below in reply ↓

Claude Code read my iPhone’s hidden privacy log. 9 apps were watching me. one of them I forgot I even had it started with the battery. dead by 3pm every day. warm in my pocket with the screen off I thought it was just old. it wasn’t there's a setting buried at the very bottom of Privacy & Security. App Privacy Report it quietly logs every time an app touches your: → location → photos → mic → camera → and every server it talks to almost nobody turns it on 12:03, I turned it on. put the phone in my pocket. lived a normal day 16:00, I opened it the list didn’t fit on the screen so I exported it, opened my laptop and gave Claude Code one prompt: replay my day and tell me who was watching it started printing. it didn’t stop for 2 minutes → 2,340 events in 4 hours → 9 apps checked where I was → 6 apps opened my photos → 47 different tracker servers → 3 apps were busiest while I wasn't even touching the phone then Claude printed the summary. one name was at the top of every list an old puzzle game I haven’t opened it since March. it’s not even on my home screen anymore. I forgot it existed today it asked for my location 48 times. every 5 minutes. on the bus, in the shop, at home it talked to 23 servers. 17 of them were ad trackers I’d never heard of at 14:37 it woke up on its own. phone in my pocket. screen off it knew where I was all day. I didn’t even know it was still there I deleted it. took back 14 permissions from 8 other apps. 5 minutes by 10pm my battery was at 40%. it used to be dead by 3 your check tonight takes 3 minutes: App Privacy Report → Settings → Privacy & Security → turn it on, look tomorrow location → nothing needs “Always” except maps and Find My photos → only your camera and gallery need “Full Access” mic and camera → if you can’t say why an app needs it, turn it off apps you forgot → if you haven’t opened it this month, it shouldn’t be watching you found something? screenshot the report first, then take the permission back save this. check your phone tonight. then check your mom’s the Opus 5.5 prompt I used ↓

Opus 5.5 is the best planner you'll ever pay for, and the most expensive typist. one model setting splits the job: /model opusplan plan mode → Opus 5.5 thinks execution → Sonnet 5.5 writes the code it switches by itself the moment you leave plan mode the whole loop: → Shift+Tab into plan mode → Opus 5.5 reads the repo, picks the approach, writes the plan → you approve the plan → Sonnet 5.5 builds it in the same session, same context the math on one long session (API prices, no cache): all on Opus 5.5: ~$5.60 opusplan: ~$3.08 Opus 5.5 costs $4 / $20 per million tokens, Sonnet 5.5 costs $2 / $10. about 90% of a session is execution, so most of your tokens drop to half price. on Pro/Max that means your limit lasts longer both phases get the 1M context window on the API. if yours doesn't, use /model opusplan[1m] the full tree > /model opusplan > plan mode: Opus 5.5 plans > you approve > execution: Sonnet 5.5 builds > stuck? Shift+Tab back into plan mode and Opus takes over again paste this into Claude Code ↓ "Switch me to /model opusplan. For this task: enter plan mode, read only what you need, and write a plan with the files to touch, the risks and a test checklist. Stop and wait for my approval. After I approve, implement it step by step and run the tests after each step." ↳ code.claude.com/docs/en/mode…

my friend's old Android sat in a drawer for 2 years. now it runs his whole flat no new gadgets, one prompt. the full setup and the exact prompt are below ↓ 5 minutes before he gets home he taps one button in Telegram: /home and by the time he opens the door: > the lights are on > the AC has already cooled the room > his playlist is playing > his PC is booted and on the desktop the phone that did all of it never left the shelf. it's plugged in, on Wi-Fi, running one small script Opus 5.5 wrote for him how it works: → Termux turns the old phone into a tiny Linux box → a Telegram bot sits there and waits for /home → Wake-on-LAN sends one packet and the PC wakes up → smart plugs and the AC get their commands over local Wi-Fi → the music starts on the speaker in the room → no cloud, no subscription, no new gadgets except a couple of cheap plugs paste this into Claude Code ↓ "I have an old Android phone with Termux on my home Wi-Fi. Write a Python Telegram bot that runs there and on /home: 1. sends a Wake-on-LAN packet to my PC 2. turns on my lights and AC 3. starts my music playlist on my speaker 4. replies with what turned on First ask me which lights, AC and speaker I have, then pick the right way to control each one. Only respond to my Telegram user ID. Add /off and make the bot start when the phone reboots. Walk me through the Termux setup one step at a time." best upgrade a drawer phone ever got

your 5-hour limit doesn't die while you work. it dies when you come back from a break and type <continue> one variable fixes most of it: export CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS=100000 the prompt cache lives about an hour. leave a long session longer than that, and your next message re-reads the whole thing at full price. since this month Claude Code fights back: → at ~54 min idle it compacts the session, right before the cache expires → by default only for sessions over 200K tokens → the variable drops that to 100K, so mid-size sessions get saved too check it's on: /config → Idle compaction the variable is one piece. the full setup has 3 more: → the resume warning, shipped yesterday. resume an old chat and Claude Code tells you when it will eat a big part of your 5-hour limit. pick "start new" and just mention the old chat. Claude looks it up instead of reloading all of it → CLAUDE_CODE_AUTO_COMPACT_WINDOW=200000. write the full number. "200k" was silently turning into a 100K window until this week's fix → /usage at the end of a long day. it now flags max effort, workflows, always-on context and huge tool results, the usual limit killers the full tree > long session goes idle > ~54 min: idle compaction, before the cache expires > sessions from 100K included with the variable > resume warning before an expensive reload > /usage shows what actually ate the limit paste this into Claude Code ↓ "Audit my Claude Code setup for usage-limit leaks: 1. Add CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS=100000 to my shell profile. 2. Check /config and make sure Idle compaction is on. 3. If CLAUDE_CODE_AUTO_COMPACT_WINDOW is set anywhere, rewrite it as a full number (200000, not 200k). 4. Add one line to CLAUDE.md: when I come back to an old task after a break, start a new session and reference the old one instead of resuming it. Show every change as a diff first. Don't apply anything until I say go." ↳ code.claude.com/docs/en/chan… the model isn't what's eating your limit. the coffee break is.