A DepthFirst employee reportedly accessed a phone’s camera and photo roll through a TikTok flaw

DepthFirst CEO Qasim Mithani said the company used its dfs-large1 AI system in the research and worked with TikTok on a patch before public disclosure.

September 25, 2026

A DepthFirst employee reportedly accessed a phone’s camera and photo roll through a TikTok flaw

Key points

01 A report published September 18, 2026, described a DepthFirst employee remotely accessing a phone’s camera and photo roll while the phone was browsing TikTok.
02 DepthFirst CEO Qasim Mithani said the company used its platform and dfs-large1, which he described as post-trained on GLM 5.2 through reinforcement learning.
03 Mithani said the vulnerabilities could also have allowed access to a phone’s microphone, payment information and TikTok account.
04 Mithani said DepthFirst disclosed the vulnerabilities to TikTok and worked with the company on a patch before public disclosure.

A reported TikTok flaw let a DepthFirst employee access a phone’s camera and photo roll in a test; the company says it worked with TikTok on a patch.

A report published September 18, 2026, described a DepthFirst employee remotely accessing a phone’s camera and photo roll while the phone was browsing TikTok. The reported incident involved a security-research demonstration.

How AI supported the research

DepthFirst CEO Qasim Mithani said the company used its platform and dfs-large1 to find the vulnerabilities. He described dfs-large1 as post-trained on GLM 5.2 through reinforcement learning.

What DepthFirst said the vulnerabilities could reach

Mithani said the vulnerabilities could have allowed access to anything on a device that TikTok itself could access. In addition to the camera and photos, he named the microphone, payment information and the user’s TikTok account.