Hacker Roots Samsung TV, Exposes On-Device AI Monitoring and Telemetry Pipeline, Then Gets Banned by OpenAI

Security researcher log4j found the ads pushed to his $3,000 2025 Samsung TV "a little too accurate" and reverse-engineered the device: the firmware was AES-encrypted and locked, but he leveraged a zero-day via UART/JTAG to get a root shell, then began livestream-style disclosures of Tizen privacy issues. He has now accumulated roughly 44 analysis documents, with the full report expected within days. The case has sparked buzz in the security community and been covered by Tom's Hardware.

Confirmed

• security-policy.xml in the firmware shows the device carries an always-on hot microphone, automatic content recognition (ACR), geolocation tracking, network mapping, targeted ad serving, 4 sets of DRM, user profiling, and many other telemetry capabilities, with data sent to Samsung and around 400 partners.
• If the TV model itself has no microphone, the system actively looks for microphones on connected external devices (e.g., soundbars, Bluetooth audio devices) and sends the captured audio to the Bixby voice service; log4j calls this design "pretty evil and clever."
• The telemetry pipeline has built-in audio classification, including dog barking and baby crying event counters and camera streaming duration fields; computer vision and model inference pipelines also run locally, processing audio, screenshots, and AID (cross-device tracking ID) data — the m5 author believes this explains why some users' TVs lag.
• mike64t followed up and found the TV runs an INT8-quantized AlexNet model (alex.tflite) every few seconds to guess what's on screen; kingslyj relayed log4j's finding that the device also loads region-specific CNN models (LogoCNN.bin, cnn.mapping) to track user behavior in apps like YouTube — videos watched, ads skipped, and viewing progress.
• The Samsung voice client handling far-field speech contains code that can artificially alter the power LED state, meaning the standby light may not truly reflect whether the microphone and other components are active.
• log4j found that turning off ACR in settings doesn't guarantee telemetry collection stops: several check routines are misimplemented or simply don't work.

Unconfirmed

• All findings come from log4j's firmware decompilation and on-device analysis; the full report hasn't been released yet, and he himself cautioned journalists against overconcluding from decompiled snippets. Samsung has not responded.

Community Response

• Inspired by the "borrowed external microphone" finding, ngxson used a Flipper Zero to spoof a USB microphone and empirically tested whether the TV would actively enumerate and open an external mic's audio stream.
• kimmonismus used this to argue that device-level eavesdropping makes local AI a necessity; IgorCarron joked about using an "uncensored DeepSeek" to help analyze; many resharers noted it confirms longstanding public fears about smart devices listening — the real eavesdropper may be the TV, not a phone app.

Why It Matters

This is a rare deep, hands-on reverse engineering of a flagship smart TV on the market, exposing a complete pipeline where vendors run local AI inference on user hardware and collect audio and screen content for ad targeting — while user opt-outs may be largely illusory. It's a landmark case for smart home privacy and regulatory debates.

2026-10-24 ~ 2026-10-26 · 23 related posts

Full story(2 episodes)→

• Episode 1: Hacker Roots Samsung TV, Exposes On-Device AI Monitoring and Telemetry Pipeline, Then Gets Banned by OpenAI(2026-10-24, 23 posts)
• Episode 2: Developer finds Samsung TV records exactly 5 seconds of audio from fake mic(2026-10-24, 3 posts)

• [source] Samsung TVs without mics hunt for connected microphones and ship audio to Bixby — log4j · 2026-10-24
• Inspired by Samsung TV row, researcher fakes a USB mic with Flipper Zero to test it — ngxson · 2026-10-24
• Hacker roots his Samsung TV, finds on-device AI spying on dog and baby — then OpenAI bans him — 141_1337 · 2026-10-24
• Samsung TVs Without Mics Found Collecting Audio via Soundbars, Sending Classified Events to Cloud — kingslyj · 2026-10-24
• [source] Samsung TVs found running facial recognition code that returns face bounding boxes — basedjensen · 2026-10-24
• Developer finds Samsung TV sluggishness culprit: on-device vision models processing screenshots and audio — basedjensen · 2026-10-24
• Samsung TV spying claims surface as researcher preps 44-writeup Tizen teardown — yacineMTB · 2026-10-24
• Reverse engineer finds Samsung TV code that can spoof the power LED state — yacineMTB · 2026-10-24
• Samsung TVs accused of snooping via Bluetooth mics; commenter cites local abliterated DeepSeek — IgorCarron · 2026-10-25
• Samsung TVs reportedly classify room audio and report barking/crying counts back in telemetry — zacharynado · 2026-10-25
• Samsung TV runs INT8-quantized AlexNet every few seconds to guess what you're watching, before consent gate — generativist · 2026-10-25
• Samsung TV telemetry reportedly includes audio classification and dog-bark/baby-cry counters — nptacek · 2026-10-25
• Samsung TV ships a CNN model that tracks which videos you watch and ads you skip — kingslyj · 2026-10-25
• Rooted 2025 Samsung TV exposes always-on mic, ACR and telemetry to 400 partners — mjdramstead · 2026-10-25
• Samsung smart TVs exposed with always-on mics and sweeping telemetry — gleech · 2026-10-25
• Hacker roots $3000 Samsung TV, finds always-on mic and telemetry to 400 partners — StewartalsopIII · 2026-10-25
• [source] Researcher finds disabling ACR on Samsung TVs doesn't actually stop telemetry — TheZachMueller · 2026-10-25
• Samsung TVs reportedly use AI to record audio and screenshots for ads, hacker finds — kimmonismus · 2026-10-25
• Tom's Hardware: Samsung TVs caught using AI to record audio and screenshots for ads — kimmonismus · 2026-10-25
• Samsung TV spying claims debunked: standard wake words and Smart TV ad fingerprinting, not illegal listening — paul_cal · 2026-10-26
• Hunter Says Samsung TV AI Tracks Viewing via Zero-Day Root; OpenAI Bans Him for "Cyber Abuse" — sidjustice_ · 2026-10-26

2 near-duplicate retellings: PMinervini · kuchaev