The TV no long spy's on us
On September 6, Gamers Nexus published packet captures of LG TVs scanning home networks and buffering voice audio. The community found a root and I took advantage of freeing my TV.
This even while watching the Denver Summit play, Hermes and I rooted a 2025 LG 55QNED82AUA, webOS 25, firmware 33.31.61. It now has none of the daemons that used to ship data to LG. Everything still works as it did before.
Why do this?
On September 6, Gamers Nexus published 216,000,000 Spy TVs, with Level1Techs and a group of security researchers. Packet captures, firmware inspection, about 500 hours of testing. Their G5 crawled the lab network and found phones and smartwatches belonging to people who did not know the work was happening. They pulled microphone audio off a TV that was unplugged from the network, stored locally in plaintext. Steve Burke: "This is the TV's native functionality. This didn't require vulnerabilities."[1]
LG answered on September 12. The coverage had "contributed to misconceptions." Audio is processed locally and promptly deleted. They do not collect ambient conversations unless voice was turned on. Scanning the network, they said, is a standard feature for connecting devices.[2]
Settings and router DNS can prevent most of this, and ours were already mostly right but by rooting we get a home screen we control, ARC s off and the promo tiles are gone. The process is dead and I can verify that.
The tools were already public. REA is an MCP server that lets an agent reverse-engineer firmware. It has about 379,000 stars, and after the video people on X pointed it at webOS.[3] slopbro is the exploit we used. It covers webOS 4 through 11 and works around LG's patch of the jsserver bug.[4] The README says an LLM wrote part of the Python. r/webos already had it working on 33.31.61.
Hermes on my Mac mini did the shell work. I made the calls.
The panel
Before we touched the TV, the plan went to a three model panel with an adversarial prompt. It helped me have more than one opinion if I was potentially making some new e-waste or not. The panel said DNS blocks are good enough if I want to just stop ad tracking but the procedure likely wouldn't brick it.
No dump before root
Hermes read autoroot.sh from the local clone before we ran it. It does not write boot or recovery. It writes a marker directory, installs one Homebrew Channel package through LG's own installer, and elevates that service. A black panel needs boot writes this script does not make. I risk I had to accept was Root first, dump right after.
The run
It took 8 seconds. Much faster then most other devices I have rooted, but I guess this TV has a 4 core CPU in it.
The Homebrew Channel ships with a default root password, so the first login installed our public key and the password stopped applying on the next boot. Telnet ships on. It went off. The update block went on. Then the whole eMMC, 7,818,182,656 bytes, streamed to the mini and checked against the live device by hash at three offsets. No partition table. The map is compiled into the board.
Where it messed up
- The first dump died immediately. The output directory did not exist, the redirect failed, the process exited. Started over.
- After a restart the dashboard check said not running, and Hermes nearly called the boot hook broken. The hook waits six seconds into boot on purpose. The check ran inside that window.
- Two wrong usernames before
prisoner.
Glasshouse
Glasshouse installed in one pass. Server, watchdog, boot hook, a tile on the home screen. The first API response had remote control and power on, with no token. Anyone on the LAN could have turned the TV off. A random token went into the config the same minute. 401 without it, 200 with it. The token is in a local file on the mini, not in the synced notes.
A restart brought the dashboard back on its own. Prime Video, YouTube, Paramount all still played.
Seven services
Then the switches: telemetry uploader, remote diagnostics, the ACR miner, promo popups, remote logging. A USB camera listener and a car-to-home daemon went with them. The car daemon never had a car.
After the restart, a root shell showed no process for any of them, and ACR's service did not answer its own call. The screen says seven disabled. The shell says seven gone.
End state
- Rooted. Homebrew Channel in. SSH is key only. Telnet is off.
- Full eMMC image on the mini, checked against the live device.
- Auto-update off. Homebrew Channel blocks LG's update hosts. The router block is configured and not applied yet.
- Glasshouse on 8080. Token required. Power actions stay on behind the token.
- Seven telemetry services stopped, checked from the shell.
- Prime Video plays. HDMI switches. Nobody noticed.
- Glasshouse Home is on. YouTube still launches from it.
This is won of the many reasons I love Hermes and AI. From the movie Hackers: "snoop onto them as they snoop on to". With AI I can hand it the forensics but keep the veto.
Sources
Gamers Nexus, "216,000,000 Spy TVs | The LG Smart TV Problem", September 6, 2026. The investigation video, with Level1Techs and security researchers. ↩︎
LG Electronics, "Statement: Understanding Privacy on LG Smart TVs", September 12, 2026. LG's denial. ↩︎
morluto, REA (Reverse Engineer Anything). An open source MCP server that lets AI agents reverse-engineer software, from app behavior down to native binaries. About 379,000 stars. People on X pointed it at webOS TVs after the September 2026 investigation. ↩︎
throwaway96, slopbro. The root exploit used here, webOS 4 through 11, including the workaround for LG's patch attempt. The webOS Homebrew Channel is the app and root tooling it installs. ↩︎