Security researcher and bug bounty hunter @log4j says he found multiple privacy-related issues after reverse-engineering his own newer 2025 Samsung smart TV, then later said OpenAI suspended his account for “cyber abuse.”
His claims center on telemetry tied to audio, screen captures, and a cross-device advertising identifier, or AID. The full technical write-up has not been released, and both Samsung and OpenAI had not publicly responded to the case by press time.
Root shell access and an unpublished write-up
According to the source material, @log4j posted a thread in the early hours of Oct. 22, Taipei time, saying he had obtained root shell access on his own Samsung TV and uncovered a number of privacy-related irregularities. He said the firmware was protected with AES encryption and difficult to unpack, so he used a zero-day to get in. He added that a full write-up was still in progress.
On Oct. 25, Taipei time, Tom’s Hardware compiled the thread into a report. Around the same time, Hugging Face engineer ngxson said a Flipper Zero test showed the microphone staying on for about five seconds before stopping. That device, however, had already been rooted and had several settings turned off, so behavior on an unmodified TV may differ.
What he says the TV is doing on-device
@log4j wrote around Oct. 24, Taipei time, that the TV uses its own hardware for post-processing and that telemetry covers audio, screen captures, and a cross-device advertising ID. In his account, computer vision and model inference run locally on the television rather than sending everything to the cloud for processing.
That description frames the living-room screen as an edge device that analyzes content while it is being watched. In another post the same day, he pointed to region-specific convolutional neural networks, or CNNs, and said they track in-app behavior, including what is watched on YouTube, which ads are skipped, and how far playback has progressed.
External microphones are part of the dispute
For models without a built-in microphone, he said the system looks for microphones on connected soundbars or Bluetooth devices and then routes audio to Bixby. That would make the issue larger than whether the TV itself has a mic. It would also raise questions about whether external audio input paths in the living room can be used by the system.
He says turning off ACR should not be treated as proof telemetry stopped
Automatic Content Recognition, or ACR, is the first setting many users would think to disable. But on the evening of Oct. 25, Taipei time, @log4j said users should not assume telemetry stops just because ACR is switched off in the menu. He wrote that some checks were implemented incorrectly, and in some cases may not have been checked at all. At the same time, he urged reporters not to overread his disassembly snippets because the full report was still being prepared.
That caveat matters. The presence of counters or code paths does not by itself show that a user was notified, and it does not prove that full audio recordings were transmitted out. He also said he had not yet traced the entire lifecycle in detail. For now, the source material says only that he believes the menu switch should not be fully trusted. It does not establish what data every unmodified Samsung TV actually sends.
Dog barks, baby cries, and the gap between official messaging and the researcher’s concerns
@log4j also said the TV classifies audio it hears and reports it back to Samsung, with telemetry context that includes preference settings and counters for dog-bark and baby-cry events. In the source article, the core dispute is framed less as whether the TV can detect those sounds and more as whether reporting and ad-tracking practices are transparent.
Samsung’s own product messaging around Vision AI, SmartThings Pet Care, and Family Care has already said that microphones can be used to detect dog barking and baby crying and send alerts. Those features require activation in SmartThings, and only some higher-end models support sound sensing.
The article treats these as two separate tracks. One is Samsung’s stated pet-care and family-care use case. The other is the researcher’s challenge over consent scope, transparency, and ad-related data collection. Another post mentioned face-boxing code, but the evidence described so far goes only as far as drawing a box around a face, not identifying who the person is.
OpenAI suspension claim remains unanswered publicly
The same episode also raised a separate question about how AI platforms handle security research. On the evening of Oct. 23, Taipei time, @log4j posted that OpenAI had banned him over reverse engineering, costing him about $500 and banked resets. He included a screenshot of an email labeled “Cyber Abuse.”
He said he never used OpenAI to find vulnerabilities or launch attacks and only carried out local reverse engineering, yet still triggered Daybreak. OpenAI had not publicly commented on the suspension by press time, and Samsung had not publicly answered his specific allegations either.
What is known so far
At this stage, what can be confirmed is that the thread pushed the issue of living-room edge AI and advertising telemetry into public view, and media outlets have started following it. What is still missing is the full technical write-up. The next points to watch are the report itself, whether Samsung or OpenAI responds, and whether the behavior can be independently reproduced on unmodified devices.