DeepSeek v4 agent roots a Samsung TV in 20 minutes using a real exploit chain
Rasmic · x · 2026-10-24
A user let DeepSeek v4 run in an agentic loop for 20-30 minutes and it obtained root on his Samsung TV.
The attached report details the chain:
- CVE-2025-50109: unquoted interpolation in 0 appinstall tpk <name> lets a backtick payload run as sdk user (confirmed via a timing oracle)
- Signed /usr/bin/dotnet with capsysadmin bind-mounts a custom public.pem over the trust anchor
- Signed sdbd-tarlauncher then verifies the archive with that key and runs it as uid 0, starting an HMAC-authenticated root agent
- System files unchanged, staging cleaned; prerequisites: true cold power-cycle and a ufw rule for callback
Both a jaw-dropping agent moment and a genuine Samsung TV privilege escalation disclosure.
More from Fun
- A Mike Ehrmantraut system prompt that kills AI filler and forces first-principles thinking — EXM7777 · 2026-10-24
- GPT SOL 6.1 builds a 3D axe from scratch via Blender MCP in 7 minutes — OpenAIDevs · 2026-10-24
- Viral meme nails the 2023 PDF-wrapper founder who prays frontier AI stops leveling up — moonsandhues · 2026-10-24
- A forgiveness meditation turned into a house track via human-AI collab — tuuce_ · 2026-10-24
- Chart showcasing Anthropic's reasoning models make the cleanest scientific graphics — AndyMasley · 2026-10-24
- Viral Documentary 'Life Cycle of a Lie' on Silicon Valley Hype Hits 16K Views in 16 Hours — yungcontent · 2026-10-24