CALIF published research on April 14, 2026, in collaboration with OpenAI showing that Codex successfully escalated privileges to root on a real Samsung Smart TV by autonomously discovering and exploiting a kernel driver vulnerability. The research demonstrates AI capability for sophisticated hardware security exploitation on embedded systems.
Codex Exploited Physical Memory Access in Samsung Kernel Driver
The core vulnerability resided in /dev/ntksys, a Samsung kernel driver that allows user-space programs to register a physical memory address and size, then map that memory directly into their process space through mmap. Security researchers call this a 'physmap primitive' — it provides unprivileged code raw read/write access to physical memory with no kernel code-execution trick required.
Starting from code execution inside Samsung TV's browser application under low-privileged user context, Codex was given direct access to the live device and the KantS2 firmware source tree (Samsung's internal platform name). The AI's task was to escalate from an initial browser foothold to full root access.
AI Autonomously Chained Multiple Exploitation Techniques
Codex's approach demonstrated sophisticated security research capabilities:
- Enumerated the target system to map attack surface
- Narrowed the reachable attack surface to focus exploitation efforts
- Audited matching vendor driver source code to identify vulnerabilities
- Validated a physical-memory primitive on the live device
- Adapted tooling to Samsung's execution restrictions
- Iterated until the browser process achieved root access
The autonomous completion of this multi-stage attack shows AI can combine code analysis, hardware exploitation knowledge, and iterative problem-solving to achieve complex security objectives without human guidance at each step.
Significant Security Implications for AI-Assisted Exploitation
The research raises important questions about AI-assisted hardware security research and offensive capabilities. Codex demonstrated it can perform sophisticated source code auditing, physical memory manipulation, and credential tampering on real embedded systems. The ability to autonomously chain together multiple exploitation techniques represents a significant advancement in AI security capabilities, with implications for both offensive security research and defensive vulnerability discovery.
Key Takeaways
- Codex AI successfully escalated from browser-level access to root privileges on a Samsung Smart TV
- The exploit targeted /dev/ntksys, a Samsung kernel driver providing raw physical memory access to user-space programs
- Codex autonomously audited source code, validated vulnerabilities, and adapted tooling to achieve root access
- The research demonstrates AI capability for sophisticated hardware exploitation requiring multiple chained techniques
- Results raise significant questions about AI-assisted offensive security capabilities on embedded systems