# Smart TVs Enlisted as Unwitting Proxies in Massive AI Web-Scraping Operation


Millions of consumers who installed free apps are unknowingly lending their home internet connections to one of the world's largest proxy networks, funneling web-scraping traffic for AI training and data harvesting. A new technical analysis reveals how Bright Data, which operates over 400 million residential IP addresses, has scaled a model that turns always-on devices—particularly smart TVs—into exit nodes through an iOS SDK embedded in seemingly innocuous applications.


The research, published June 5 by Include Security and independent researcher Buchodi, exposes significant gaps between what users consent to and what actually happens on their networks. The findings come as AI companies race to harvest training data and traditional anti-scraping defenses force malicious actors and legitimate businesses alike toward residential proxies to evade detection.


## The Threat: Your Living Room as Someone Else's Gateway


The core risk is straightforward but insidious: when a user's device becomes a proxy exit node, their home IP address and bandwidth are conscripted into commercial infrastructure without meaningful visibility or control.


What's at stake:


  • Bandwidth depletion: Devices can transfer up to 200 GB per month (far higher in some countries), consuming metered home connections and potentially triggering ISP throttling or overage charges
  • Network resource hijacking: Always-on devices like smart TVs are ideal targets—plugged in, on fast connections, often unmetered and unmonitored by their owners
  • ISP detection risk: Home connections flagged for scraping activity may be subject to ISP warnings, slowdowns, or service suspension
  • Compliance exposure: Users may unknowingly expose themselves to legal liability if their IP is flagged for accessing protected content or violating terms of service
  • Background relay capability: The SDK continues relaying traffic while the user watches the screen or takes calls, as long as battery isn't critically low

  • The immediate threat is not account compromise or data theft from the user. It is the silent conscription of network resources into a commercial proxy operation, with disclosure that does not match reality.


    ## Background and Context: From Hola to Bright Data's AI Boom


    This business model is not new—it is mature and normalized.


    The evolution:


    In 2015, the free Hola VPN service was caught selling its users' bandwidth to Luminati, a paid proxy service, at $20 per gigabyte. Users who installed Hola for privacy were unknowingly becoming exit nodes in a residential proxy network. Hola responded with statements about transparency and user benefit, but the damage was done: the model was exposed as exploitative, even if technically disclosed in obscure terms.


    Luminati evolved and rebranded as Bright Data, which now markets itself as the "largest residential proxy network in the world." The company publicly touts its AI-friendly positioning, advertising to customers who need to bypass anti-bot defenses and rotate residential IPs for large-scale data harvesting.


    What changed is the scale and the buyer. Anti-scraping systems from Cloudflare, DataDome, and others have become sophisticated enough to block datacenter IP ranges. This has made residential proxies invaluable for AI companies training on web-harvested data. Previous proxy networks like the criminal Aisuru botnet and the now-dismantled IPIDEA (shut down by Google in January 2026) had to *hijack* devices; Bright Data presents itself as the ethical alternative, operating with "consent."


    The problem: consent without meaningful disclosure is not consent.


    ## Technical Details: Weak Authentication, VPN Bypass, and the Consent Gap


    The iOS SDK analysis reveals security and disclosure failures that warrant scrutiny from regulators and platform holders.


    Authentication weakness:


    When an app opens, the SDK contacts a Bright Data server. That server hands over instructions and scraping jobs without meaningful authentication. The researcher found that the peer channel carrying these scraping commands has no real security checks—described as weaker than most malware's command-and-control infrastructure. An attacker or rogue insider could, in theory, hijack that channel and redirect devices to scrape sensitive sites or participate in DDoS activity.


    VPN bypass:


    The researcher documented that on iPhones, SDK traffic slips past a user's configured VPN. This means a user running a VPN for privacy or security still participates in the proxy network unencrypted and unfiltered. The traffic also doesn't surface in standard security monitoring tools that enterprises use to audit application behavior.


    The disclosure mismatch:


    Bright Data's SDK is deployed in apps accessed through official app stores. The permission screen presented to users often vastly understates what the SDK actually does. Example: In one Roku app called Petflix, the permission screen stated the device would be used "occasionally." The settings the SDK actually loads permit up to 200 GB of traffic monthly. In countries like Uzbekistan and Oman, limits are set substantially higher, and devices can keep relaying until the battery is nearly depleted.


    The SDK also ties together multiple devices running the same app—phones, tablets, computers—and treats them as a single user, further obscuring the true scope of what's being shared.


    Affected platforms:


    Bright Data's partner list includes makers of smart-TV apps such as PlayWorks Digital, CloudTV, and Longvision. While being on that list doesn't confirm an SDK is currently present in any given app, it establishes the technical capability and business relationships that enable deployment at scale.


    ## Implications: AI Training at the Expense of Home Networks


    The practical implications ripple across users, ISPs, and the regulatory landscape.


    For home users:


    Unexpected bandwidth consumption can trigger ISP throttling, overage fees (where applicable), or service restrictions. ISP abuse teams monitor for suspicious activity; a home connection flagged for scraping—even if the user consented to the app—could face warnings or disconnection.


    For security teams:


    Enterprise networks may contain employee personal devices running these apps. Traffic from those devices, now routed through Bright Data's infrastructure, is harder to monitor and audit. A security team relying on VPN logs or DNS monitoring may miss activity that occurs outside their tunnel.


    For ISPs and networks:


    Bright Data's traffic patterns are observable at scale. Some ISPs may already be blocking or rate-limiting known proxy traffic. The arms race between anti-scraping and proxy networks will continue to intensify as AI demand for training data grows.


    For regulators:


    The consent-disclosure gap is a regulatory issue. FTC enforcement around dark patterns and deceptive practices has targeted apps that hide material terms in settings. This falls into that category: users are not being clearly informed of the true scope of bandwidth consumption and network use.


    ## Recommendations: What Users, Platforms, and Defenders Can Do


    For individual users:


  • Audit permissions: Check app permissions and behavior in app settings. Look for unusual network traffic or battery drain.
  • Disable background activity: Restrict apps from running in the background where possible.
  • Monitor bandwidth: If you suspect an app is consuming unusual data, check your router logs or ISP account for usage patterns.
  • Read permission screens carefully: If an app requests permission to use your network, ask why. "Occasionally" should mean occasional.
  • Uninstall if uncertain: If you don't need an app, removing it removes the risk.

  • For platform holders (Apple, Google, Roku):


  • Strengthen disclosure requirements: Require apps to disclose data consumption caps and actual usage patterns at install time, not in buried settings.
  • Monitor SDK behavior: Work with researchers to audit popular SDKs for unauthorized network activity or VPN bypass.
  • Enforce VPN integrity: On iOS, apps should not be able to route traffic around a user's configured VPN without explicit, separate consent.

  • For security teams:


  • Monitor third-party app inventory: Catalog the SDKs and data-sharing relationships in applications deployed on corporate or BYOD devices.
  • Segment personal devices: If employees use personal devices on the network, apply network segmentation to monitor and limit their activity.
  • Track residential proxy traffic: Include Bright Data IP ranges in your external monitoring and threat intelligence feeds.

  • ---


    ## HackWire Analysis


    The Bright Data research matters now because AI demand for training data has fundamentally inverted the proxy market economics. For years, residential proxies were a niche tool used by smaller operations and criminals. Today, they are mainstream infrastructure for companies training large language models and harvesting competitor data at scale.


    The consent story is the hinge on which this case turns. Bright Data markets itself as ethical because users opt in; rivals like Aisuru and IPIDEA were shut down because they hijack devices. But opt-in with disclosure that doesn't match reality is a distinction without substance. Users who agreed to "occasional" network use have been enrolled in an operation that can burn 200 GB per month—a number no reasonable person would agree to if they understood it.


    The deeper pattern: as anti-bot defenses improve, legitimate and illegitimate scrapers are converging on the same solution—residential proxies sourced from consumer devices. Cloudflare, Akamai, and others are winning the battle against datacenter proxies, but winning the battle is losing the war if the traffic simply migrates to residential networks instead. Bright Data's scale (150+ million IPs) shows that this model has moved from fringe to industrial.


    The iOS SDK findings are particularly damaging. Weak authentication on the command channel and VPN bypass suggest that Bright Data's engineering prioritizes speed and scale over security. An SDK that can be hijacked or that silently bypasses a user's privacy tools is worse than transparent surveillance—it is surveillance infrastructure that can be repurposed.


    Finally, there is the timing question: why now? AI companies need training data faster than they can ethically source it, and residential proxies solve that problem. Until regulation catches up or platforms enforce stricter controls, this model will proliferate. The question for defenders is not whether Bright Data is the only operation running this play—it is almost certainly not. Researchers should expect to find similar SDKs in other app ecosystems, and regulators should treat this as a disclosure and consent enforcement issue across the board.


    HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)