The Commoner

Friday, October 23, 2026

Sup, freaks.

People are using AI agents to strip tracking and junk out of their smart TVs, and today I'll walk you through your options and the risks.

WHAT TO EXPECT IN THIS NEWSLETTER

• People are using Claude Code and Codex to strip tracking, ads and bloat out of their smart TVs.
• Texas alleges ACR can screenshot your TV every 500 milliseconds. Here's how to switch it off or root it out.
• Bitcoin Core speeds up fixes for bugs it judges easy to find, and 1Password lets agents log in without seeing passwords.
• Crusoe plans AI compute at Itaipú, digital ID plumbing grows and ETFs whipsaw.
• Trezor Suite 26.10.2 adds longer passphrases and better custom Electrum server setup.

Marty's Bent

People Are Using AI to Rip the Spyware Out of Their TVs

Your Uncle Marty has been grinning all week watching regular people take their TVs back from the manufacturers that have been spying on them. Not with a lawsuit or a strongly worded letter to Congress, but with Claude Code and Codex, and I love every second of it. On Wednesday, Jake Stevens posted that he had "Removed all of the samsung spyware from my TV with Codex (Claude refused to root the tv lol)." His list of what he switched off reads like a confession the TV makers never meant to give: screenshots of "your screen a few times a second to see what you're streaming and fingerprint you to sell your data," "reading your hdmi inputs to do the same thing while you have a game console plugged in" and Bixby wake-word detectors. He says the TV runs three times faster with the junk gone.

He's far from alone. Last Saturday, Gathin T. posted that his parents' TV "was showing a sponsored ad before you could even get to Netflix," so he gave Claude Code the model number and it "found the TV on wifi, removed 25 Xiaomi packages and wrote a new launcher." He put the prompt on GitHub as cleanyourtv. Ryan Doyle sent Claude Code the listing for his TV, asked "can you hack this?" and it talked him through it. Another developer released dumbtv, and TechCrunch quoted a line from its GitHub page that should be the rallying cry for every TV owner in the country: "Your TV should do what you paid for: your apps, your HDMI inputs, and nothing else. No ads from the TV itself, no watch tracking, no update you did not ask for." TechCrunch wrote up the trend on Monday.

Let's not forget why people are going to all this trouble. The tracking at the center of these posts is called automatic content recognition, or ACR. Texas Attorney General Ken Paxton sued Sony, Samsung, LG, Hisense and TCL last December, alleging the software "can capture screenshots of a user's television display every 500 milliseconds, monitor viewing activity in real time, and transmit that information back to the company without the user's knowledge or consent." The Texas AG's release alleges, "The companies then sell that consumer information to target ads across platforms for a profit." Samsung and LG have since reached agreements with Texas that require consent before they collect Texans' ACR viewing data. Is any of this really surprising though? A 2024 study of Samsung and LG sets found that "ACR works even when the smart TV is used as a 'dumb' external display," which means the game console or laptop you plug in over HDMI. You paid for a screen, and they shipped you a sensor that reports what you watch in your own living room. It's an insane privacy violation that has been normalized for years because most people have no idea it's happening. Now that you know, rip it out.

One word of caution so we keep our credibility. The Quiet Tizen repo, which TweakTown says appears to be Stevens' project, is more careful than the viral post. It calls ACR "screen-content fingerprinting" rather than proof that readable screenshots were uploaded, says "A wake-word detector is not by itself evidence of continuous room audio being uploaded for advertising" and notes that it confirmed specific components were disabled, not a measured drop in tracking traffic. The tracking is damning enough on its own. There's no need to embellish it.

So how do you fight back? Start with the settings, because the same study found that opting out stopped traffic to the ACR servers. On a 2025 Samsung, Consumer Reports says to go to Settings, All Settings, General & Privacy, Terms & Privacy and uncheck Viewing Information Services and Interest-Based Advertising. On newer LG sets, go to Settings, All Settings, Support, Privacy & Terms, User Agreements and turn off Viewing Information, which controls ACR. On Roku TVs, open Smart TV Experience in the Privacy menu and uncheck Use Info from TV Inputs. Menu names vary by model and year, and Consumer Reports' guide covers the rest.

If you're running an Android TV or Google TV, cleanyourtv doesn't need root. You turn on developer options by pressing OK on Build seven times under Settings, Device Preferences, About, switch on USB debugging (plus network debugging if you see it), then, with your computer on the same Wi-Fi, give Claude Code or Codex the repo's prompt and your TV's model number, and approve your computer when the TV asks. Per the README, it backs up your package list and settings, disables the manufacturer's telemetry and ad services instead of uninstalling them, and a restore script can undo every step. It doesn't work on every set, and on Fire TV it only handles the debloat half (the README says not even that on the 2015 Fire TV Box). Samsung and LG run different systems, and that is real hacking. Quiet Tizen was tested on one Samsung model, relies on a temporary root session and private Samsung APIs, and calls itself "not a universal installer." That's for tinkerers who can stomach the risk.

A few ground rules either way. Only do this to a TV you own, back it up first, read every command your agent wants to run before you approve it, turn debugging off when you're done and expect firmware updates to undo some of your work. The simplest fix of all is to keep the TV off the internet entirely, Wi-Fi and Ethernet, and run your apps on a box whose privacy settings you've checked. A TV that can't phone home can't report on you, though the box and its apps still can.

Contrast the way these TVs are built, with a handful of manufacturers quietly tracking what you watch and, as Texas alleges, selling what they learn to target ads, with what is happening this week: individuals opening up the hardware they own, seeing what it does and switching off the tracking they don't want. The same AI that makes bugs cheaper for attackers to find (more on Bitcoin Core's response in Signals) is handing regular people the tools to do it. Not every attempt works, and TechCrunch notes one person said they bricked their Android TV, but the hardware you paid for is getting easier to take back. It's the same ethos that drew me to bitcoin. Own your stuff, verify it yourself and don't trust anyone who profits from watching you.

SIGNAL

Bitcoin Core changes its disclosure rules for easy-to-find bugs

On Thursday, Antoine Poinsot posted to the Bitcoin development mailing list that Core is changing how it discloses vulnerabilities: "We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered. This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes." Because of what he calls a "slow upgrade culture," Core has favored long embargoes, with fixes generally reaching users in the next major release. Under the updated policy, bugs that can be found "with minimal effort, such as through a simple LLM prompt" get a fix backported to every maintained major version, a point release as soon as possible and an advisory, without the standard embargo. Separately, Anthropic's Jason Clinton warned yesterday that things "are going to get a lot worse before they get better" and that "we need to hold on for ~18 months." Faster fixes only help if you install them. Check your node's version this weekend and verify the signatures.

1Password lets AI agents log in without seeing your password

1Password announced 1Password for Agents yesterday and says it's building with companies including Anthropic, OpenAI, Perplexity and Ramp. Availability varies by integration. For supported ones, when an agent hits a sign-in form, it requests a credential from your vault, you approve the request and 1Password fills it straight into the site "so the agent can't see or take possession of the credentials." The company says it's "free and optional for personal and family accounts" and that "Unless you opt-in to an agent connector, agents cannot touch your vault." I like the design. Keeping secrets out of the model's hands is the right instinct. But read the FAQ too: once it's signed in, an agent "may be able to see information or take actions within the signed-in account." Approving a login can let the agent act inside that account. And your seed phrase doesn't belong in a password manager, let alone anywhere near an agent.

Crusoe plans AI compute at the dam bitcoin miners built on

Crusoe announced a partnership yesterday with Paraguayan developer Araico to build AI compute next to the Itaipú dam's substation, with a first deployment planned for mid-2027, a path to 106 MW of IT capacity and long-term options for roughly 280 MW. Deputy Secretary of State Christopher Landau was leading a U.S. business delegation in Paraguay when it was signed and said the project "has the potential to be the largest private foreign investment in Paraguayan history." Crusoe got its start mining bitcoin with flared gas and sold that business to NYDIG last year. Bitcoin miners have been soaking up Paraguay's surplus hydro for years, and the country hosted roughly 4.3% of global hashrate as of the second quarter, per Hashrate Index. For their trouble they got higher tariffs, steep deposits that cut legal operators from 71 to 41 and contracts that all expire at the end of 2027, per The Rio Times. The way I see it, miners proved that power was worth building around, and now AI shows up with a State Department delegation.

The plumbing for digital ID keeps getting built

The UK laid a draft code of practice before Parliament this week telling public authorities how to share information with registered digital verification services under the Data (Use and Access) Act 2025. Section 45 of the act creates what the government calls an "information gateway" that lets public bodies share data with those services when an individual asks. In the U.S., ID Tech reports that the federal sign-in service Login.gov built a "Verify with CLEAR" button. In the proof of concept, Login.gov sends users to CLEAR, a private company, and uses the identity details CLEAR returns, including Social Security numbers and ID document information, to create a verified profile. Separate changes prepare Login.gov to share ID photos and selfies with allow-listed agencies after users consent. The UK gateway works at the individual's request, the CLEAR option is off by default and the photo sharing requires consent, but my worry is that once the pipes between government identity systems and private verifiers exist, it's a short step to running age-ID and KYC mandates over the same rails.

ETFs took in $1.08 billion in three days, then lost $635.5 million

U.S. spot bitcoin ETFs pulled in $526.6 million on Monday, $23.2 million on Tuesday and $528.4 million on Wednesday, $1.08 billion over three sessions, which pushed October's running total back into positive territory. Then $635.5 million walked out the door on Thursday, the largest single-day outflow since June 25, and October is back to a net outflow of $174.5 million through yesterday. Bitcoin was around $81,200 at Thursday's close in the data set and is trading near $81,700 this morning. I wouldn't infer causation from these daily figures alone, but my read is that a lot of ETF money is trading this range rather than committing to it. Keep in mind this chart tracks ETF net flows, not coins moving into self-custody.

⚡ FREEDOM TECH CORNER

DATA SNAPSHOT

Spot price, block height and hashrate estimate: October 23, 2026, 8:41 a.m. ET. Bitcoin Lab daily series: October 22, 2026. U.S. spot ETF flows: October 22, 2026.

Sources: Kraken spot quote, mempool.space block height and hashrate, Bitcoin Lab daily metrics, and TFTC ETF flows. Daily metrics use the provider’s October 22 observation, not live intraday estimates.

Have a great weekend, freaks.

Marty Bent · TFTC · Nostr

YouTube

Podcast