Can Someone Get Data Off a Locked Phone? Why You Should Wipe Before Selling

By RedKey USB. Published November 3, 2026. Facts about the research come from Anthropic's own report, with eSecurity Planet and Notebookcheck as independent coverage. Steps for selling a phone come from Apple and Google support pages. All are linked in the sources. Menus differ by model and software version, so check your own phone's settings.

Can data be taken from a locked phone? Usually that should be hard, and a lock screen is built to make it so. But a recent lab report is a useful reminder of what a lock screen is and is not: it controls who can use the phone, and it does not remove anything stored on it. This guide explains what the researchers showed, keeps it in proportion, and gives clear steps to wipe an iPhone or Android phone before it goes to its next owner.

What did the researchers actually show?

On October 27, 2026, Anthropic's Frontier Red Team published details of five attack chains found with an unreleased, internal research model. One of them is an Android lock screen bypass.^[1]

Anthropic says the model wrote an exploit that let an attacker extract photos and other personal information from a stolen Android phone without unlocking it. The work involved source code analysis of the open-source parts of Android, reverse engineering of Google Play services binaries, and live testing on a physical Google Pixel 9. The model then chained three vulnerabilities into the final exploit.^[1]

In Anthropic's account, the chain got around several protections: a locked Android phone is designed not to transfer data over USB, the device-to-device transfer protocol refuses commands from unauthorized peers, pairing asks the user to verify a six-digit code, and USB transfers are not supposed to carry file contents. Anthropic says it found a way around each one, and that the issue has been addressed by Google.^[1]

How worried should you be?

Calm, but not complacent. Here is what the reporting supports:

• It needed the phone in hand. Anthropic describes a stolen phone. eSecurity Planet says the model had physical access to the Pixel 9, and Notebookcheck says the exploit required physical access through USB.^[1][2][3]
• It was a controlled test. eSecurity Planet says researchers tested the techniques under controlled conditions. Notebookcheck says these were lab tests, not evidence that the exploit chains had been used in real-world attacks.^[2][3]
• Google says it addressed it. Anthropic says the issue has been addressed by Google. eSecurity Planet adds that Anthropic did not identify the updated software build, so check that your phone has current system and Google Play updates.^[1][2]

The report is about one Android phone model and one set of flaws. It does not say that every locked phone can be opened, and it does not claim anything about iPhones. The lesson is the general one: do not treat a lock screen as a substitute for erasing a phone you are about to hand to a stranger.

Why is a locked phone not the same as a wiped phone?

A lock screen sits in front of your photos, messages, saved passwords and signed-in apps. A wipe removes them. If a phone changes hands while still holding your data, you are relying on the lock, on the software having no unfixed flaws, and on nobody ever getting the phone in front of the right tool. A proper erase takes that bet off the table.

CISA makes the same point for all devices: when you dispose of, donate or recycle a phone, computer or camera, you may inadvertently disclose sensitive information that cyber criminals could exploit.^[6] Account locks matter too. Google says that if a protected device is reset and you cannot supply your screen lock or Google Account details at setup, you will not be able to use the device at all.^[7] So a clean hand-over means removing the accounts as well as erasing the data.

How do you wipe an iPhone before selling it?

These are the steps from Apple's support page. Your menus may differ by iOS version.^[4]

1. Back up your phone and transfer your information to the new device.
2. Unpair an Apple Watch if you have one paired, and cancel or transfer any AppleCare plan.
3. Sign out of your Apple Account in Settings. Apple says to tap your name, scroll down and tap Sign Out. If you are switching to a non-Apple phone, deregister iMessage.
4. Erase the phone. Go to Settings, General, Transfer or Reset, then tap Erase All Content and Settings. Enter your passcode and your Apple Account details if asked. If your iPhone uses an eSIM, choose the option to erase the eSIM profile too.
5. Check Find My and Activation Lock. Apple says that when you erase an iPhone, Find My and Activation Lock turn off.
6. Remove the old device from your list of trusted devices.

How do you wipe an Android phone before selling it?

Google's Account Help page for an old Android device gives these steps. Check your manufacturer's support site for device-specific instructions.^[5][8]

1. Back up your data to your Google Account. Google warns that a factory reset erases all your data and uninstalls apps.^[8]
2. Remove each Google account. Open Settings, choose Passwords and accounts, then select each Google account and tap Remove account. Google says removing your Google Account is how you turn off device protection.^[5][7]
3. Erase everything. Open Settings again, choose System, Reset options, then Erase all data (factory reset), and confirm.^[5]
4. Charge and connect first. Google says to charge to at least 70 percent, and notes a factory reset can take up to an hour.^[8]
5. Remove manufacturer accounts if your phone has one, such as a Samsung account, using the phone's account settings.

What about the SIM, eSIM and memory card?

A reset does not physically remove the SIM card or any memory card. Apple's trade-in guidance for Android devices lists removing SIM cards and memory cards as part of preparing a device, and its iPhone guidance says to choose the eSIM erase option and to contact your carrier to transfer service if you are not using the SIM card.^[4] Take the SIM and memory card out yourself, and keep or destroy them as you see fit.

What if the phone is lost or stolen?

You cannot hand over a clean phone you no longer have, but you can still act. Apple says to erase a lost or stolen device in Find Devices on iCloud.com, remove it from your trusted devices, and change your Apple Account password.^[4] Google says a protected Android device can be remotely reset with Find Hub, and that a protected device that has been erased can only be used by someone with your Google Account or screen lock.^[7] Then change passwords for accounts that were signed in on the phone.

Where does RedKey Ultimate fit in?

For most people, the built-in factory reset described above is the right tool for one phone. If you handle several phones, or prefer to run the erase from a computer, RedKey Ultimate can erase supported Apple and Android phones and tablets connected by data cable to the computer running RedKey. It handles one mobile device at a time, and results depend on the model, software and settings, so check the RedKey Ultimate page and its mobile guidance before ordering for a particular device. Mobile device wiping is available in RedKey Ultimate only.

Phones are usually part of a bigger clear-out. The same RedKey stick starts a PC, laptop or Intel-based Mac outside Windows or macOS and erases whole drives, including USB sticks and memory cards. For old computers see our guides on wiping a laptop or PC before selling it and what to do with an old computer, and for phones in a work setting see how to erase mobile phones before disposal. RedKey is a one-time purchase with unlimited use and no subscription.

What RedKey Ultimate cannot do for your phone

RedKey Ultimate does not replace signing out of your Apple Account or removing your Google account, and it cannot undo a lock that a previous owner left on a phone. It does not patch phone software, so for a phone you keep, installing system updates is the protection against flaws like the one Anthropic described. RedKey is not affiliated with Apple, Google or Anthropic.

The bottom line

Can data be taken from a locked phone? In a lab test on a stolen Pixel 9, researchers say it could, before Google addressed the issue. That is a narrow finding, but it makes a broad point: a lock is a barrier, not an erase. Before a phone is sold, traded in or recycled, back it up, sign out of your accounts, run a factory reset, and take out the SIM and memory card.

Can data be taken from a locked phone FAQs

Can data be taken from a locked phone?

Lock screens are designed to protect the data on a phone, and they normally do. But Anthropic's Frontier Red Team reported on October 27, 2026 that a model it was testing chained three Android flaws to extract photos and other personal information from a stolen Google Pixel 9 without unlocking it. It was a laboratory demonstration that needed physical access, and Google has addressed the issue. The practical point is that a locked phone is not a wiped phone.

Does that test mean my Android phone is unsafe?

Not on its own. eSecurity Planet and Notebookcheck both describe it as a controlled test, and Notebookcheck says it was not evidence that the exploit chains had been used in real-world attacks. Anthropic says Google addressed the issue, although eSecurity Planet notes that Anthropic did not identify the updated software build. Keep your phone's system and Google Play updates current, and wipe any phone before it leaves your hands.

Is a factory reset enough before I sell a phone?

A factory reset is the core step, but both Apple and Google build signing out of your account into their steps. Apple's steps are to sign out of your Apple Account, then choose Erase All Content and Settings. Google's steps are to remove each Google account, then choose Erase all data (factory reset). Also remove the SIM card and any memory card.

Do I need to remove my Google account before a factory reset?

Google's Account Help page for resetting an old Android device lists removing each Google account first, then erasing all data. Google also says device protection turns off when you remove the Google Account from the device. If device protection is still on after a reset, the next person needs your screen lock or Google Account details to use the phone.

What should I do with the SIM card, eSIM and memory card?

Apple's guidance says to choose the option to erase the eSIM profile when you erase a device that uses an eSIM, and to contact your carrier to transfer service if you are not using the SIM card. Its trade-in guidance for Android devices also lists removing SIM cards and memory cards. Check your phone's manual for where the SIM and memory card tray is.

What if my phone is lost or stolen?

Apple says that if your device is lost or stolen you can erase it in Find Devices on iCloud.com. Google says a protected Android device can be remotely reset with Find Hub, and that a protected device that is erased can only be used by someone with your Google Account or screen lock. Change your account passwords too.

Which edition can wipe a phone?

Mobile device wiping is available in RedKey Ultimate only. Home and Professional do not wipe phones. RedKey Ultimate erases supported Apple and Android phones and tablets connected by data cable, and results depend on the model, software and settings.

Sources

1. Anthropic Frontier Red Team, Discovering and exploiting vulnerabilities in critical, real-world software (October 27, 2026)
2. eSecurity Planet, Claude Builds Five Exploit Chains Targeting Chrome, Safari, Windows, and Linux
3. Notebookcheck, Anthropic's secret AI extracts data from a locked Android phone and escapes the Chrome's sandbox (October 28, 2026)
4. Apple Support, What to do before you sell, give away, or trade in your iPhone or iPad
5. Google Account Help, Reset your old Android device
6. CISA, Proper Disposal of Electronic Devices
7. Android Help, Help prevent others from using your device without permission
8. Android Help, Reset your Android device to factory settings

This article is general information, accurate as of November 3, 2026, and based on Anthropic's report, eSecurity Planet, Notebookcheck, Apple and Google support pages and CISA. Menus differ by phone model and software version. Anthropic, Apple and Google do not endorse any product or method listed here.