Skip to content
MONDAY, OCTOBER 26, 2026

Independently reported.

Tech

A Hacker Says Samsung TVs Capture Audio and Screenshots for Ads. The Proof Is One Rooted TV and a Promised Writeup

Researcher log4j says Samsung's Tizen software on a 2025 TV profiles viewers for ads. Samsung has not responded, the full writeup is unpublished, and the one outside mic test saw five seconds of recording.

By Mara Voss, Technology

· 4 min read · Updated

A large flat-screen television glows with soft blurred color in a dark living room, a slim soundbar beneath it.
Illustration: Trestlewire

Key Takeaways

  • •Researcher log4j began posting on October 21, 2026 that a 2025 Samsung TV running Tizen collects audio categories, screenshots and viewing behavior for ad targeting.
  • •The one outside microphone test, by Hugging Face engineer ngxson on October 23, saw the mic open for five seconds and no further activity for hours, on a TV already rooted with settings disabled.
  • •As of October 26, 2026, no independent test has confirmed the claims, Samsung has not publicly answered them, and log4j's roughly 44-writeup report is unpublished.
  • •The posts did not show that microphone data caused the targeted ads that started the investigation, per Zeniteq.

The headline version says Samsung TVs record audio and screenshots to target ads. The evidence so far is a thread on X from one researcher, one 2025 television, and a writeup that has not been published. Samsung has not publicly answered.

The short answer

A researcher using the handle log4j says Samsung's Tizen software on a 2025 TV collects audio categories, screenshots and viewing behavior for ad targeting. No independent test has confirmed it. The one outside microphone check, on a rooted TV, saw a single five-second recording. The claims began October 21, 2026, and the full writeup is still pending.

What log4j actually posted

On October 21, log4j wrote that a relatively new Samsung TV kept showing weirdly targeted ads. The firmware was AES encrypted and no keys were available, so the researcher says they used zero-day flaws to get a root shell instead. The post ended with "discovered PRIVACY HORROR. write up?" The post did not include a reproducible exploit, according to Zeniteq's review of the thread.

Later posts made the larger claims. Per Tom's Hardware, log4j described a region-specific neural network that tracks which videos a user watches, which ads get skipped and how far playback progressed. A follow-up posted a screenshot from a file named security-policy.xml. By October 23, Zeniteq reports, log4j was pointing to telemetry paths with barking and crying event counters, sensor preferences and camera-streaming duration. The argument: audio gets classified on the TV before anything is reported to Samsung.

Samsung does advertise microphone-based barking detection in its Pet Care feature, Zeniteq notes. That makes a barking counter unsurprising. It does not show that room audio reaches an ad system.

5 seconds

microphone open time in the one outside test

Hugging Face engineer ngxson, October 23, on a TV that was already rooted with settings disabled. No further recording followed for hours.

The one outside test

Hugging Face engineer ngxson tried to reproduce the microphone behavior with a Flipper Zero, per Tom's Hardware. The TV opened its microphone for five seconds and then stopped. Hours later, nothing more had happened. ngxson added a caveat that cuts both ways. That TV was already rooted with several settings off, so a stock set might behave differently.

That is one TV, one tester, and a test whose own author says it may not transfer. It neither confirms continuous recording nor rules out recording under other settings.

Where the headline outruns the thread

Tom's Hardware headlined its report with the claim that Samsung TVs use AI to record audio and screenshots for ads. The body is more careful. It says the tester theorizes that the sluggish interface comes from heavy on-device processing. A theory about slow menus is not a recording log. Lowyat.NET, which ran the story Monday, says the findings are not independently confirmed. It adds that they do not establish that every Samsung TV continuously records users.

Zeniteq makes the sharpest point. The posts did not show that microphone data caused the ads that started the investigation. Code that could capture audio, a capability present in firmware, is a different finding from audio that was captured, sent and used for targeting. Which capabilities are switched on by default, and what actually leaves the TV, are the open questions.

The report is also promised, not delivered. By October 24, log4j said a longer document of about 44 writeups on individual functions would come within days. As of Monday it was not in the public record.

One more claim rests only on log4j's account. Tom's Hardware reports that OpenAI banned the researcher's account for cyber abuse. log4j disputes that, saying the tools were used only for local reverse engineering and blaming a primitive classifier. I found no statement from OpenAI.

What other TV makers have said

Samsung is not the first maker accused of this. Lowyat.NET notes LG has faced similar scrutiny and has denied that its TVs continuously record or transmit conversations. LG's official statement says its content-recognition feature works by audio fingerprinting, not screenshots or video recordings, and that it is optional and off by default. That is a company's description of its own product, and it has been disputed. It is also the kind of statement Samsung has not yet issued here.

I could not find a count of Samsung TVs running the code log4j describes. I also found no earlier audit of Tizen ad telemetry to measure this against. The thread covers one 2025 set. Until the writeup lands and someone reproduces it on an unmodified TV, the accurate summary is short. A researcher says the firmware can do this. Nobody has shown it happening at scale.

  • Samsung
  • Tizen
  • smart TV privacy
  • automatic content recognition
  • log4j

About the reporter

Mara Voss

Technology Reporter, Trestlewire

I spent seven years as a product manager at a mid-size SaaS company before I ever wrote a sentence for pay, which means I have sat through more roadmap reviews than most people would tolerate in a lifetime. I watched a scheduling feature get rebranded three times before it shipped, and I watched a launch date slide past four straight quarters while the slide deck stayed exactly the same. That is where the question I still ask every day came from: does this actually ship, or is it a demo.

Read full bio and all stories →