Security enthusiast reverse engineers Samsung TV, then ChatGPT account gets banned; Claude also restricts the reverse-engineering tool REA

Even more absurdly, Claude has also started putting the brakes on "reverse engineering everything."

Just today, Claude was revealed to have banned overnight the wildly popular reverse-engineering tool REA, topping trending searches and igniting heated discussion across the internet.

Many people have found that as soon as they ask Claude to take apart software, it suddenly slams on the brakes halfway through writing, and even rephrasing doesn't help.

On the same day, Anthropic and OpenAI came down hard on "reverse engineering everything."

Taking apart their own TV

ChatGPT account gone first

The protagonist of this incident that set the whole internet ablaze is a security enthusiast, @log4j.

A few days ago, @log4j discovered that the ads pushed to his family's 2025 Samsung TV were eerily precise. So he decided to take matters into his own hands and crack it open to see.

It turned out this wasn't so simple.

Samsung had encrypted the entire TV firmware with AES; without the key, ordinary reverse-engineering methods all failed against this wall.

In the end, the developer had to resort to a "zero-day vulnerability" to pry open root access and burrow into the machine's underlying system.

When @log4j actually got inside, he saw things an ordinary user would never see in their lifetime.

Always-on voice, dog-bark detection, 400 parties sharing the spoils

alwaysonvoice.

Even without saying "Hi Bixby," it stays on, always listening. Going deeper into the system, @log4j unearthed a complete surveillance pipeline, each item of which is enough to send chills down one's spine on its own:

ACR (Automatic Content Recognition): what show you're watching, what ad, what image—it compares frame by frame and records it all.

Geolocation: where the person's home is, down to the precise location.

Network mapping: which devices are connected at home—phones, computers, smart speakers, cameras—it draws a map of your entire home network.

A complete telemetry data pipeline: every time you power on, change channels, adjust the volume, how long you stay—all packaged and uploaded.

Four independent DRM systems: reinforced layer upon layer to ensure this data business runs smoothly.

He even found a piece of code that can distinguish dog barks from a baby's cries and count each separately.

This TV doesn't just want to know what you're watching; it also wants to know whether you have a dog, whether you have kids, and how many times the child cried.

Put together, this information forms a family profile precise enough to be chilling.

And where does all this data ultimately flow? To Samsung itself, and to more than 400 partners.

A TV priced at $3,000 has become a 24/7 data collection terminal. And behind it is a massive business with over 400 parties sharing the spoils.

Once the post went out, it instantly flooded the feeds, with 1.3 million people pouring in to watch.

The first thing countless people did in the comments was the same action—get up in the middle of the night and unplug the TV's network cable.

At first glance, netizens seem to be making a fuss over nothing, but this is by no means groundless or baseless.

In December 2025, the Texas Attorney General filed lawsuits against Sony, Samsung, LG, Hisense, and TCL over ACR data collection (screenshotting roughly every 500ms, etc.).

According to research from Northeastern University, 82% of households in the US own smart TVs, and these TVs may be quietly recording your every move.

They found over 57 million ACR (Automatic Content Recognition) detection records from other users' TVs, and anyone could even read them directly without logging in.

And the real problem this research reveals is:

You may simply have no way of telling whether the privacy switch you turned off actually took effect.

And the problem with smart TVs goes beyond privacy—everyone has long suffered from smart TVs!

More than surveillance: smart TVs aren't "TVs"

Recently, many developers have started sharing their own TV modification solutions:

Their goal is simple: to turn increasingly bloated smart TVs back into clean, simple TVs whose only job is to play content.

For example, one afternoon, developer Gathin T. saw the overwhelming ads on his parents' TV screen and simply couldn't stand it anymore, so he decided to clean it up.

But this time, he didn't write the code from scratch himself; instead, he went straight for Claude Code.

Later, he recalled:

I had Claude Code connect to the TV over Wi-Fi, clean out all that junk, and then make a simple home screen that kept only the apps my parents would actually use.

Then I put the prompt on GitHub and posted a before-and-after comparison of the TV modification on X.

As a result, in just two days, thousands of people followed this method to modify their own TVs. Xiaomi, TCL, Sony, Fire TV, LG, and even one or two projectors.

Currently, the project has over 30,000 stars and more than 400 contributors on GitHub.

Some users found that simply telling Claude "help me crack the TV" made the AI unwilling to cooperate at all, and that more specific, more complex prompts were needed to proceed.

And now, more trouble has arrived!

The truly surreal plot is only just beginning.

42 hours later, the iron fist of account bans came down

Just 42 hours after @log4j's post went viral, OpenAI made its move.

An email informed him that his ChatGPT account had been directly banned for "Cyber Abuse." @log4j said outright that he had lost about $500 on the spot.

Because of this, he was furious and publicly defended himself:

I have never used OpenAI to hunt for vulnerabilities, to attack anyone, or to carry out any kind of cyber sabotage. I was only doing reverse analysis locally on my own home TV.

Logically, it was unassailable, but the iron fist of the ban was not withdrawn.

And almost at the same time as OpenAI banned him, Claude on the other side also quietly made its move.

Claude also made its move

Just a few days ago, on Reddit, a developer posted about his experience:

He asked Claude to help write a reverse-engineering workbook. Claude wrote along fine at first, but halfway through, it suddenly stopped and told him that "a safety check had halted its response."

He tried rephrasing the question, but Claude still refused to continue.

Soon after, another developer, Irushi, posted about an almost identical scenario: using Opus 5.5 together with REA for reverse-engineering research, Claude analyzed in an orderly way at first, but as it wrote, the safety guardrails suddenly triggered and it directly refused to write further.

At this point, the story came full circle.

The two giants, one banning a person and the other banning a tool, completed a tacit encirclement of the "reverse everything" trend.

REA, the wildly popular tool, surges to No. 1 on GitHub

What exactly is REA, which exposed the Samsung TV in public and put both OpenAI and Anthropic on high alert?

REA stands for Reverse Engineer Anything, meaning "reverse everything."

The name is wild enough, and its strength matches that wildness.

In essence, it is an MCP server plus a command-line tool, open-sourced under the most permissive MIT license. Look at the timeline below to get a sense of how fast it took off:

April 14: the project was quietly open-sourced on GitHub; October 8: it shot to No. 1 on the GitHub trending list; October 19: its star count surpassed 330,000.

An open-source tool racking up hundreds of thousands of stars in less than a month after launch—what kind of concept is that?

At the time, developers across the internet were spreading the word: "Another OpenClaw-level marvel has appeared."

Why is it so popular? Because it turns something that originally had an extremely high barrier to entry into a one-sentence matter.

Traditional reverse engineering is a genuine "craft." You first have to choose tools—Ghidra, IDA, Hopper—then learn their respective interfaces, manually move evidence from one program to another; finally, you have to rely on experience to judge where to look next.

What REA does is package this entire complex process and hand it to AI agents to run.

After installing it with a single command, npx rea-agents setup, mainstream coding agents such as Claude Code, Codex, Cursor, and Gemini CLI can invoke it with one click.

Next, all you have to do is say one sentence in plain language: "Help me figure out how this feature is implemented."

The rest is all left to the AI. It will dispatch Ghidra, IDA, or Hopper on its own, automatically obtain pseudocode, assembly instructions, strings, symbol tables, and function call relationships, and like a detective following the trail, trace all the way to the lowest-level code logic behind the feature.

What it can take apart is astonishingly broad, covering almost every form in the software world.

Native binaries, JavaScript and Electron apps, .NET assemblies, Android APKs and devices, websites and packet capture records, and even firmware, WASM, and SQLite databases.

Even more rare is its "evidence system." REA strictly divides every conclusion into three tiers: directly observed, logically inferred, and speculative.

It never packages guesses as facts. When the data is incomplete, it honestly tells you, "This part is incomplete."

It is precisely this ability to "expose everything with one sentence" that sends chills down the backs of the big companies.

"Abusing the TV"—who exactly is the abuser?

But in this drama, who is the victim?

A TV that eavesdrops on what you say every day, profiles your home network, can count how many times your child has cried, and then sells all of this to 400 companies—is it the victim?

Someone who spent $3,000 to buy it and just wanted to see clearly what it was doing behind his back instead becomes the abuser?

Identities have been completely inverted.

When you try to resist, try to see the truth clearly, OpenAI turns around and tells you with a righteous face: you are abusing it.

This is the most glaring part. The TV seems to have been endowed with some kind of inviolable dignity.

This has long gone far beyond the technical question of whether reverse engineering is compliant. This is an ethical issue, and one in which the manufacturers have quietly made the choice for us.

The big companies are truly afraid that reverse cracking itself has suddenly lost its barrier to entry.

In the past, those who could pry open commercial black boxes were a very small number of top security experts—limited in number and high in cost—and the big companies could still cope. But now, tools like REA have handed a key that can open all doors to every ordinary developer.

Once everyone has a hammer, even the most sophisticated black box will sooner or later be cracked open. Today it is a Samsung TV; tomorrow it might be some app's paywall.

Who will the next press of the ban button be meant to protect?