Researcher breaks into a 2025 Samsung TV and reports hidden audio and ad tracking

A security researcher who goes by “log4j” broke into their own 2025 Samsung TV after it kept showing oddly specific ads, and has been posting what they found inside on X since October 21.¹ The researcher says the TV’s software includes an “always on voice” service, sorts the sounds it hears, analyses screenshots and viewing habits on the TV itself, and reports to Samsung and, in their words, “their 400 partners”.^{1, 4} Samsung disputes the claims, and nobody has yet confirmed them on an ordinary, unmodified TV.^{5, 6}

Reporting checked October 29, 2026.

Too long; didn’t read?

• The TV’s firmware is encrypted, so the researcher used security flaws Samsung had not yet fixed to take full control of the running TV and look at its software directly.¹
• They report sound detection with counters for dog barking and baby crying, screenshot processing, a cross-device advertising ID and a service that maps and logs your home network.^{2, 4, 5}
• The full technical write-up was still unpublished as of October 26, and the only outside test so far saw the microphone open once, for five seconds.^{3, 7}
• Samsung says its content-recognition feature is off by default and collects nothing when switched off. Separate university research found traffic consistent with that feature on Samsung TVs after users had opted out.^{5, 8}
• The researcher’s own advice: keep the TV off the internet and stream from a separate box.⁴

How the researcher got inside the TV

Samsung TVs run Tizen, Samsung’s own operating system. The researcher first tried to study the TV’s firmware, the software package that runs the set, but wrote that it was “aes encrypted”: scrambled with a key that isn’t available without taking the TV apart and wiring into its circuit board.¹ Instead they used “zero days”, security flaws Samsung had not yet fixed, to get a root shell: full administrator access to the TV while it is running, where its software can be read and inspected.^{1, 5}

Tom’s Hardware reports that the researcher used OpenAI’s AI tools in the work, and that OpenAI then banned their account for “cyber abuse”. The researcher says they used the tools only for reverse engineering on their own TV, not to find or exploit vulnerabilities, and blames an automated filter. TrestleWire found no statement from OpenAI.^{3, 7} AI is becoming a common helper for this kind of work: in April, the security firm Calif published how OpenAI’s Codex turned a foothold in a Samsung TV’s web browser into full control of the set.¹⁰

What the researcher says is inside

• Microphone features. The researcher wrote of “always on hot mic functionality”, and Malwarebytes reports they found a package called “always on voice” that uses the TV’s microphone to pick up sounds in the room.^{1, 4} On October 23 they posted that the TV “classifies what audio it hears, before reporting back to samsung”, with dog-barking and baby-crying event counters built into its data reporting.⁵
• Borrowed microphones. On TVs without a built-in microphone, the researcher says the software looks for a connected device that has one, such as a soundbar or a Bluetooth device.^{3, 4}
• Screenshots and viewing habits. They say the TV processes audio, screenshots and your “aid”, a cross-device advertising ID, on its own hardware, and suggest that is why the menus feel sluggish.² They also describe a neural network tailored to each region that, in YouTube, looks at “videos you watch, ads you skip, progress in a video”, Malwarebytes reports.⁴
• Your home network. The researcher reports geolocation, mapping of the local network, and a service called “rmdemon” that starts a packet logger on your network and, they believe, can also open a remote live viewing stream.^{2, 4}
• The off switch. They warn that turning off content recognition in the TV’s menu “should not be assumed to actually disable ACR telemetry”, because in several places they found the setting checked incorrectly or not at all.⁴

What is confirmed, and what isn’t

So far the evidence is one researcher, one 2025 TV and a series of posts with screenshots and names of software components. The promised full write-up had not been published as of October 26, according to MLQ and TrestleWire.^{6, 7} MLQ notes that a service called “alwaysonvoice” shows a voice feature exists, but on its own it does not prove the TV records the room around the clock or sends recordings to Samsung. The posts also have not shown that sound data caused the targeted ads that started the investigation.^{6, 7}

The only outside test came from an engineer at Hugging Face who watched the microphone on their own Samsung TV: it opened for five seconds, then nothing more for hours. That TV was already rooted with several settings turned off, so an ordinary TV may behave differently.³

Some of it matches features Samsung advertises. Samsung’s Pet Care and Family Care features use on-device AI to detect a barking dog or a crying baby and alert the owner, which could explain such counters, though not where the data goes.⁴ Samsung’s automatic content recognition (ACR), which identifies what is on screen, is also well documented. Northeastern University researchers reported in October that Samsung TVs kept sending traffic consistent with ACR after users opted out: in all 30 tests with Samsung’s own streaming app, 41 of 60 tests with antenna TV and 18 of 30 tests over HDMI. The traffic was encrypted, so they could not see what it contained.⁸ Earlier this year Samsung settled with the Texas Attorney General and agreed to get Texans’ express consent before collecting ACR viewing data.⁴

What Samsung says

A Samsung spokesperson disputed the claims and stressed user consent, Insider Paper reported on October 27. Samsung said its ACR features are off by default and must be switched on during setup, and that when they are off, viewing data is neither collected nor shared with advertising partners.⁵ Its support page adds that Samsung “does not record or watch any of the content displayed on your Smart TV”.⁹ The reported statement does not address the microphone claims.

What you can do

1. Take the TV offline. If you can live without its built-in apps, disconnect it from Wi-Fi and Ethernet. The researcher calls this the best option for immediate peace of mind.⁴
2. Stream from a separate box. The researcher suggests an Apple TV or an Android TV box you can change with open-source software.⁴ If you are buying a new screen, our TV guide lists options with no smart system at all.
3. If it stays online, switch off the tracking settings. Turn off Viewing Information Services (ACR), interest-based ads and voice recognition. Given the opt-out findings, treat this as a minimum rather than a guarantee.^{4, 8}
4. Block ACR servers at home. The Northeastern researchers publish a blocklist of ACR addresses; in their lab, blocking them did not break the TV or affect picture quality.¹¹ A network-wide DNS filter such as Technitium DNS Server can apply it to every device in the house.

Sources

1. log4j on X, October 21, 2026: “i own a relatively new (2025) samsung tv…” (thread)
2. log4j on X, October 23, 2026: “so i figured out why my samsung TV is so sluggish…” (thread)
3. Tom’s Hardware, October 25, 2026: Cybersecurity bounty hunter says Samsung TVs use AI to record audio and screenshots for ads
4. Malwarebytes, October 27, 2026: Samsung TVs without mics may listen through soundbars, researcher says
5. Insider Paper, October 27, 2026: Samsung TVs secretly listen for barking dogs and crying babies: researcher
6. MLQ, October 26, 2026: Samsung TV spying claims remain unverified after reverse-engineering report
7. TrestleWire: A hacker says Samsung TVs capture audio and screenshots for ads. The proof is one rooted TV and a promised writeup
8. Ars Technica, October 21, 2026: Does opting out of smart TV tracking work? Research finds “suspicious” traffic
9. Samsung US support: Samsung Smart TV Automatic Content Recognition (ACR) feature
10. Calif, April 13, 2026: Codex hacked a Samsung TV
11. Northeastern University: Watching the Watchers, privacy analysis of U.S. smart TV automatic content recognition