FULL STORY

Samsung TV Local AI Spying: From Reverse Engineering to Live Test

A researcher's reverse engineering of his Samsung TV revealed local AI constantly sampling audio and screenshots for ads; another developer confirmed with a fake microphone that the TV captures sound instantly, sparking privacy concerns.

2026-10-24 ~ 2026-10-26 · 2 episodes · 27 posts

Episode 1 · Hacker Reverse-Engineers Samsung TV, Finds On-Device AI Listening for Ads (2026-10-24, 24 posts)

Security researcher log4j found the ads pushed to his $3,000 2025 Samsung TV "a little too accurate" and reverse-engineered the device: the firmware was AES-encrypted and locked, but he leveraged a zero-day via UART/JTAG to get a root shell, then began livestream-style disclosures of Tizen privacy issues. He has now accumulated roughly 44 analysis documents, with the full report expected within days. The case has sparked buzz in the security community and been covered by Tom's Hardware.

Confirmed

  • security-policy.xml in the firmware shows the device carries an always-on hot microphone, automatic content recognition (ACR), geolocation tracking, network mapping, targeted ad serving, 4 sets of DRM, user profiling, and many other telemetry capabilities, with data sent to Samsung and around 400 partners.
  • If the TV model itself has no microphone, the system actively looks for microphones on connected external devices (e.g., soundbars, Bluetooth audio devices) and sends the captured audio to the Bixby voice service; log4j calls this design "pretty evil and clever."
  • The telemetry pipeline has built-in audio classification, including dog barking and baby crying event counters and camera streaming duration fields; computer vision and model inference pipelines also run locally, processing audio, screenshots, and AID (cross-device tracking ID) data — the m5 author believes this explains why some users' TVs lag.
  • mike64t followed up and found the TV runs an INT8-quantized AlexNet model (alex.tflite) every few seconds to guess what's on screen; kingslyj relayed log4j's finding that the device also loads region-specific CNN models (LogoCNN.bin, cnn.mapping) to track user behavior in apps like YouTube — videos watched, ads skipped, and viewing progress.
  • The Samsung voice client handling far-field speech contains code that can artificially alter the power LED state, meaning the standby light may not truly reflect whether the microphone and other components are active.
  • log4j found that turning off ACR in settings doesn't guarantee telemetry collection stops: several check routines are misimplemented or simply don't work.

Unconfirmed

  • All findings come from log4j's firmware decompilation and on-device analysis; the full report hasn't been released yet, and he himself cautioned journalists against overconcluding from decompiled snippets. Samsung has not responded.

Community Response

  • Inspired by the "borrowed external microphone" finding, ngxson used a Flipper Zero to spoof a USB microphone and empirically tested whether the TV would actively enumerate and open an external mic's audio stream.
  • kimmonismus used this to argue that device-level eavesdropping makes local AI a necessity; IgorCarron joked about using an "uncensored DeepSeek" to help analyze; many resharers noted it confirms longstanding public fears about smart devices listening — the real eavesdropper may be the TV, not a phone app.

Why It Matters

This is a rare deep, hands-on reverse engineering of a flagship smart TV on the market, exposing a complete pipeline where vendors run local AI inference on user hardware and collect audio and screen content for ad targeting — while user opt-outs may be largely illusory. It's a landmark case for smart home privacy and regulatory debates.

4 more related posts →

Episode 2 · Developer finds Samsung TV records exactly 5 seconds of audio from fake mic (2026-10-24, 3 posts)

Developer ngxson reverse-engineered his Samsung TV remote and, using a Flipper Zero fake USB microphone, found the TV enables the mic and records exactly 5 seconds of audio before stopping. He suspects it is a mic test routine and has open-sourced the code for verification.