# Smart TVs Enlisted as Unwitting Proxies in Massive AI Web-Scraping Operation
Millions of consumers who installed free apps are unknowingly lending their home internet connections to one of the world's largest proxy networks, funneling web-scraping traffic for AI training and data harvesting. A new technical analysis reveals how Bright Data, which operates over 400 million residential IP addresses, has scaled a model that turns always-on devices—particularly smart TVs—into exit nodes through an iOS SDK embedded in seemingly innocuous applications.
The research, published June 5 by Include Security and independent researcher Buchodi, exposes significant gaps between what users consent to and what actually happens on their networks. The findings come as AI companies race to harvest training data and traditional anti-scraping defenses force malicious actors and legitimate businesses alike toward residential proxies to evade detection.
## The Threat: Your Living Room as Someone Else's Gateway
The core risk is straightforward but insidious: when a user's device becomes a proxy exit node, their home IP address and bandwidth are conscripted into commercial infrastructure without meaningful visibility or control.
What's at stake:
The immediate threat is not account compromise or data theft from the user. It is the silent conscription of network resources into a commercial proxy operation, with disclosure that does not match reality.
## Background and Context: From Hola to Bright Data's AI Boom
This business model is not new—it is mature and normalized.
The evolution:
In 2015, the free Hola VPN service was caught selling its users' bandwidth to Luminati, a paid proxy service, at $20 per gigabyte. Users who installed Hola for privacy were unknowingly becoming exit nodes in a residential proxy network. Hola responded with statements about transparency and user benefit, but the damage was done: the model was exposed as exploitative, even if technically disclosed in obscure terms.
Luminati evolved and rebranded as Bright Data, which now markets itself as the "largest residential proxy network in the world." The company publicly touts its AI-friendly positioning, advertising to customers who need to bypass anti-bot defenses and rotate residential IPs for large-scale data harvesting.
What changed is the scale and the buyer. Anti-scraping systems from Cloudflare, DataDome, and others have become sophisticated enough to block datacenter IP ranges. This has made residential proxies invaluable for AI companies training on web-harvested data. Previous proxy networks like the criminal Aisuru botnet and the now-dismantled IPIDEA (shut down by Google in January 2026) had to *hijack* devices; Bright Data presents itself as the ethical alternative, operating with "consent."
The problem: consent without meaningful disclosure is not consent.
## Technical Details: Weak Authentication, VPN Bypass, and the Consent Gap
The iOS SDK analysis reveals security and disclosure failures that warrant scrutiny from regulators and platform holders.
Authentication weakness:
When an app opens, the SDK contacts a Bright Data server. That server hands over instructions and scraping jobs without meaningful authentication. The researcher found that the peer channel carrying these scraping commands has no real security checks—described as weaker than most malware's command-and-control infrastructure. An attacker or rogue insider could, in theory, hijack that channel and redirect devices to scrape sensitive sites or participate in DDoS activity.
VPN bypass:
The researcher documented that on iPhones, SDK traffic slips past a user's configured VPN. This means a user running a VPN for privacy or security still participates in the proxy network unencrypted and unfiltered. The traffic also doesn't surface in standard security monitoring tools that enterprises use to audit application behavior.
The disclosure mismatch:
Bright Data's SDK is deployed in apps accessed through official app stores. The permission screen presented to users often vastly understates what the SDK actually does. Example: In one Roku app called Petflix, the permission screen stated the device would be used "occasionally." The settings the SDK actually loads permit up to 200 GB of traffic monthly. In countries like Uzbekistan and Oman, limits are set substantially higher, and devices can keep relaying until the battery is nearly depleted.
The SDK also ties together multiple devices running the same app—phones, tablets, computers—and treats them as a single user, further obscuring the true scope of what's being shared.
Affected platforms:
Bright Data's partner list includes makers of smart-TV apps such as PlayWorks Digital, CloudTV, and Longvision. While being on that list doesn't confirm an SDK is currently present in any given app, it establishes the technical capability and business relationships that enable deployment at scale.
## Implications: AI Training at the Expense of Home Networks
The practical implications ripple across users, ISPs, and the regulatory landscape.
For home users:
Unexpected bandwidth consumption can trigger ISP throttling, overage fees (where applicable), or service restrictions. ISP abuse teams monitor for suspicious activity; a home connection flagged for scraping—even if the user consented to the app—could face warnings or disconnection.
For security teams:
Enterprise networks may contain employee personal devices running these apps. Traffic from those devices, now routed through Bright Data's infrastructure, is harder to monitor and audit. A security team relying on VPN logs or DNS monitoring may miss activity that occurs outside their tunnel.
For ISPs and networks:
Bright Data's traffic patterns are observable at scale. Some ISPs may already be blocking or rate-limiting known proxy traffic. The arms race between anti-scraping and proxy networks will continue to intensify as AI demand for training data grows.
For regulators:
The consent-disclosure gap is a regulatory issue. FTC enforcement around dark patterns and deceptive practices has targeted apps that hide material terms in settings. This falls into that category: users are not being clearly informed of the true scope of bandwidth consumption and network use.
## Recommendations: What Users, Platforms, and Defenders Can Do
For individual users:
For platform holders (Apple, Google, Roku):
For security teams:
---
## HackWire Analysis
The Bright Data research matters now because AI demand for training data has fundamentally inverted the proxy market economics. For years, residential proxies were a niche tool used by smaller operations and criminals. Today, they are mainstream infrastructure for companies training large language models and harvesting competitor data at scale.
The consent story is the hinge on which this case turns. Bright Data markets itself as ethical because users opt in; rivals like Aisuru and IPIDEA were shut down because they hijack devices. But opt-in with disclosure that doesn't match reality is a distinction without substance. Users who agreed to "occasional" network use have been enrolled in an operation that can burn 200 GB per month—a number no reasonable person would agree to if they understood it.
The deeper pattern: as anti-bot defenses improve, legitimate and illegitimate scrapers are converging on the same solution—residential proxies sourced from consumer devices. Cloudflare, Akamai, and others are winning the battle against datacenter proxies, but winning the battle is losing the war if the traffic simply migrates to residential networks instead. Bright Data's scale (150+ million IPs) shows that this model has moved from fringe to industrial.
The iOS SDK findings are particularly damaging. Weak authentication on the command channel and VPN bypass suggest that Bright Data's engineering prioritizes speed and scale over security. An SDK that can be hijacked or that silently bypasses a user's privacy tools is worse than transparent surveillance—it is surveillance infrastructure that can be repurposed.
Finally, there is the timing question: why now? AI companies need training data faster than they can ethically source it, and residential proxies solve that problem. Until regulation catches up or platforms enforce stricter controls, this model will proliferate. The question for defenders is not whether Bright Data is the only operation running this play—it is almost certainly not. Researchers should expect to find similar SDKs in other app ecosystems, and regulators should treat this as a disclosure and consent enforcement issue across the board.
— HackWire Editorial
---
## Related Coverage