OpenAI banned a hacker this week, two days after he took apart his own Samsung TV's firmware1.
The same day, a security researcher said Claude lost a matching skill. Anthropic has stayed silent on why4.
A root shell, then a privacy list
Log4j wanted to know why his new TV kept serving him strange ads. He went after the firmware himself1.
"i tried reversing the firmware but it was aes encrypted and no keys unless tear it apart and do uart/jtag magic," log4j wrote. The same post named what he found next: "zero days it is. root shell on new samsung TVs!"1
JTAG and UART are hardware debugging ports built into most circuit boards. A few dollars of equipment, wired to those ports, gave log4j the deepest level of control a device offers1.
A security researcher who goes by Md Ismail Šojal summarized the find a day later, to a much larger crowd. "WTF, $3000 Samsung TV has an always-on mic, automatic content recognition, geo tracking, network mapping, and ships your data to Samsung + 400 partners," Šojal wrote2.
Šojal's account is secondhand. The $3,000 price and the 400-partner count come from what Šojal saw and typed, a step removed from log4j's own log12.
A ban, then a quieter one
OpenAI banned log4j's account on Oct. 23, two days after his first post. He posted again right away3.
"banned for reverse engineering work? that's wild," log4j wrote. He named the cost too: "oh well, -$500, and a bunch of banked resets) but gained motivation to get 3 more machines and finish my cluster." Then came his defense. "i have never used openai to exploit or find vulnerabilities, only local reverse engineering which tripped daybreak," he wrote3.
Daybreak is the OpenAI program log4j names as the trigger. OpenAI left the ban itself unexplained in every source checked for this piece3.
Šojal posted again that same day, about a different company's model. "Claude can no longer 'Reverse Engineer Anything.' Anthropic just quietly killed REA," he wrote. He tied the timing to the TV story directly. "After a few viral cases of people using Claude to reverse-engineer Samsung TV firmware and identify data-collection services, Anthropic appears to have restricted those reverse-engineering abilities," Šojal wrote4.
Md Ismail Šojal 🕷️@0x0SojalSecClaude can no longer “Reverse Engineer Anything.”
Anthropic just quietly killed REA.
But Interesting timing.
After a few viral cases of people using Claude to reverse-engineer Samsung TV firmware and identify data-collection services, Anthropic appears to have restricted those… https://t.co/O6Efo6P9WH pic.twitter.com/a28eOSieuY
By Oct. 24, a poster using the name kache turned the criticism toward OpenAI's ban instead. "You aren't allowed to stop your tv from spying on your family. You have to ask for permission," kache wrote5.
Log4j's Ban Post Draws Half the Likes of the Teardown That Caused It
Likes on four X posts in the Samsung TV reverse-engineering story, as the posts showed Oct. 25, 2026
Each bar is one post's like count, in the order the posts went up; a taller bar means more readers liked that post.
Sources: log4j on X [1]; log4j on X [3]; Md Ismail Šojal on X [4]; kache on X [5]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Log4j's TV teardown, Oct. 21 | 20,992 |
| Log4j's ban account, Oct. 23 | 10,284 |
| Šojal's REA claim, Oct. 23 | 11,726 |
| Kache's criticism, Oct. 24 | 21,742 |
What REA actually is
Reverse Engineer Anything, or REA, runs apart from Anthropic's own product line. It is an open-source tool, built by a developer known only as morluto. The tool connects Claude, Codex and Cursor to established reverse-engineering programs such as Ghidra, IDA and Hopper6.
The project passed 379,500 stars on GitHub, a sign of how many developers installed it since its October launch6.
REA publishes 11 rules for what counts as fair use. Four scenarios get a green light: a user's own programs and crash dumps, open-source software, and malware tested in a sandbox. CTF puzzles, built to be taken apart, round out that list.
Three more need the owner's signed permission first: pentests, bug bounties, and work on a client's software. Four stay banned outright: selling a rebuilt copy of someone's software, cracking DRM, and beating anti-cheat. A fourth bans breaking into systems outside the tester's own clearance7.
REA's Own Rules Clear a User's Own Devices in 4 of 11 Lines
REA's published fair-use rules for reverse engineering with AI agents, by permission tier, posted Oct. 20, 2026
Each cube is one rule from REA's own list: magenta cubes clear a user's own devices already, blue cubes need the owner's sign-off, and gray cubes stay banned outright.
Source: GitHub [7]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Allowed on your own devices | 4 |
| Needs the owner's sign-off | 3 |
| Banned outright | 4 |
| Whole | 11 |
Log4j's TV work fits squarely in the first category, on paper: his own device, taken apart on his own time17.
A second TV, a different company
The guardrail reached past Samsung owners too. Journalist Jose Antonio Lanz used Claude Code this week to reinstall an ad-free YouTube app on his own LG TV. It was a repeat of an old jailbreak he had run before8.
Claude spotted an open debugging port during its scan. It flagged the risk only after telling Lanz to flip on Developer Mode, a step that wiped his existing setup8.
Lanz then asked Claude to help him root the TV again. The model offered an older, looser version of itself, then refused once the conversation touched words like "root" and "exploit"8.
Two defenses, one gap
Anthropic's own rules explain why a classifier might flinch at firmware work at all. Its usage policy bars using Claude to "develop persistent unauthorized remote access tools designed to operate below normal system security levels, including firmware modifications or hardware implants"9. The same work that exposes a spying TV can also build one.
The policy carries an exception written for exactly this case. It permits "security research, testing, or tool development conducted on systems you own or operate, with the authorization of the system owner"9. Log4j and Lanz both meet that description on paper.
Security researcher Mark Dowd reads the broader pattern as a different kind of problem. "It's not really comfortable to me that these random large companies are making arbitrary decisions about what is safe in security and what's not," Dowd told TechCrunch10.
NCC Group's chief scientist, Chris Anley, named why one prompt resists a clean split. A request is "both an offensive tool and a defensive tool, and the two can't really be unpicked," Anley said10.
The gap between the policy's exception and the model's refusal is where log4j and Lanz each landed this week189.
What to do
Security teams using Claude or ChatGPT for firmware work should document owner authorization in writing before the first prompt. Anthropic's own exception asks for exactly that paper trail. A flagged session is easier to appeal with it already in hand.
Anyone testing a device they own should plan for a sudden mid-task refusal. The flag can land on a prompt that worked a day earlier. Save firmware dumps and root access locally first, the lesson both log4j and Lanz learned the hard way.
By the numbers
- $3,000: the price Šojal's post gives for the Samsung TV log4j took apart2.
- 400 partners: how many companies beyond Samsung the post says the TV's data reaches2.
- Log4j's teardown post drew 20,992 likes as of Oct. 25, 20261.
- His ban post drew 10,284 likes the same day3.
- Šojal's REA claim reached 11,726 likes4.
- Kache's criticism topped 21,742 likes, the most of the four5.
- 379,500: REA's star count on GitHub, the open-source project both companies' models now resist running6.
- Nov. 12, 2026: when Anthropic's updated usage policy, with its security-research exception, takes effect9.
What to watch
Watch whether Anthropic publishes anything about REA, the way OpenAI eventually explains a Daybreak flag. A statement would show whether the block targets firmware work broadly or just the prompts that named a TV. Watch log4j's and Lanz's accounts too, since a reversal at either company would show which one moved first.
Sources
- log4j, "i own a relatively new (2025) samsung tv...," X, Oct. 21, 2026, https://x.com/log4j/status/2113014142600953868
- Md Ismail Šojal, "WTF, $3000 Samsung TV has an always-on mic...," X, Oct. 22, 2026, https://x.com/0x0SojalSec/status/2113208608980898022
- log4j, "banned for reverse engineering work? that's wild," X, Oct. 23, 2026, https://x.com/log4j/status/2113647464154857840
- Md Ismail Šojal, "Claude can no longer 'Reverse Engineer Anything.'," X, Oct. 23, 2026, https://x.com/0x0SojalSec/status/2113751276320399694
- kache, "Person who is reverse engineering his tv gets banned from OpenAI," X, Oct. 24, 2026, https://x.com/yacineMTB/status/2113965724435697732
- morluto, "rea: Reverse engineer anything with agents," GitHub, Oct. 17, 2026, https://github.com/morluto/rea
- morluto/rea contributors, "Using REA with Claude and other AI models: what's fine, what needs permission, and where are the legal lines?," GitHub, Oct. 20, 2026, https://github.com/morluto/rea/discussions/2304
- Jose Antonio Lanz, "How I Vibe Coded My Smart TV—And Claude Killed It," Yahoo Tech, Oct. 23, 2026, https://tech.yahoo.com/ai/claude/articles/vibe-coded-smart-tv-claude-175329213.html
- Anthropic, "Usage Policy," Anthropic, Oct. 8, 2026, https://www.anthropic.com/legal/aup
- Lorenzo Franceschi-Bicchierai, "How AI guardrails are impeding the work of offensive cybersecurity researchers," TechCrunch, July 23, 2026, https://techcrunch.com/2026/07/23/how-ai-guardrails-are-impeding-the-work-of-offensive-cybersecurity-researchers/