Samsung TV ad tracking: hacker roots his own TV

Ever get the feeling your TV knows a little too much about you? One security researcher had exactly that itch with his 2025 Samsung set, and instead of shrugging it off, he rooted the thing. What he says he found inside has turned “Samsung TV ad tracking” into the privacy story of the week, with a side of OpenAI drama for good measure.

The researcher goes by @log4j on X (yes, named after the bug, which tells you something about his sense of humour). His story starts the way these things always start: the ads on his TV were weirdly specific. Not “you watched a cooking show, here’s a blender” specific. Creepier than that.

What he says is hiding in Tizen

Samsung TVs run Tizen, and the firmware is wrapped in AES encryption, which usually ends the curiosity right there. He claims he got past it with a root exploit he’s calling a zero-day, then went digging through the code with an AI assistant doing the grunt work of the reverse-engineering.

According to his posts from October 21, the software logs which videos you watch, how far you get into them, which ads you skip, and ties all of it to a cross-device advertising identifier. That part, frankly, is the least surprising bit. Every smart TV maker has been quietly selling your viewing habits for years under the polite name of ACR, automatic content recognition.

The spicier claims are the ones about audio and screenshots. He says there’s code capable of pulling sound from connected devices with microphones, think soundbars and Bluetooth gear, and that an on-device AI model is sitting there to help make sense of what gets collected. His own summary of the situation: “Finally found a company that truly listens to its customers.”

Ouch.

The part where OpenAI banned him

Here’s the twist I didn’t see coming. Shortly after he started posting, OpenAI suspended his account for “Cyber Abuse”. He insists he only used the tools to reverse-engineer firmware sitting on his own desk, not to attack anyone. Maybe it was an automated false positive, maybe not. Either way, if you’re a researcher relying on a chatbot to read decompiled code, you’ve just been reminded that your lab partner can quit on you without notice.

Samsung, for its part, has said nothing so far. LG, which got the same kind of scrutiny earlier this year, went on record saying its ACR uses audio fingerprinting rather than recordings and is off by default. I’d expect something similar from Samsung eventually. Lawyers write these statements, not engineers.

Should you panic about Samsung TV ad tracking?

Honest answer: calm down, but don’t relax. Nothing here has been independently verified. There’s no full write-up yet, just screenshots and threads, and plenty of people who’ve shipped smart TV apps point out that “code exists for X” is not the same as “X is running right now in your living room”. A microphone permission in a policy file is not a wiretap. A sound-detection feature that listens for a baby crying is not a transcript of your dinner conversation.

But the broader picture doesn’t need this story to be true. Samsung TVs do have an advertising ID. They do fingerprint what’s on screen when you let them. And “when you let them” usually means you tapped “Agree” on a 40-page wall of text during setup because you wanted to watch something.

So here’s what I’d actually do tonight. Dig into the settings, find the privacy section, and switch off Viewing Information Services, interest-based ads, and any voice recognition you don’t use. Better still, never give the TV your Wi-Fi password at all and plug in an Apple TV, a Shield, or a little Linux box instead. A “dumb” panel with a smart stick is the only combo where you get to decide who’s doing the listening.

Your TV doesn’t need to know you, it just needs to turn on.