I've recently run into one where it's possible to make Android devices recognize the faces of people in front of the device via the front facing camera with no sign of this to the user. Someone has to actually start an app (which needs camera access) and it is possible for it to be killed, but I too did this entirely by accident and would now be super wary about it.