Claude Code shipped no TV capability: this is its general-purpose Bash tool driving ADB over TCP port 5555, a debug interface Android has exposed since 2010, and the trend started with Ryan Doyle about 36 hours before the post the video actually shows

A 24.264898 s QuickTime/MP4 (mov,mp4,m4a, major brand isom, minor version 512, compatible brands isomiso2mp41, encoder tag Lavf58.76.100) carrying one HEVC video stream (Main profile, level 150, hvc1 tag, 1080x1920, 9:16, yuv420p, bt709 primaries and transfer, 60/1 fps, 1455 frames, 520,668 bps) and one HE-AACv2 audio stream (mp4a, 44.1 kHz stereo, 48,321 bps, 526 frames, 24.264898 s), for an overall 577,980 bps and 1,753,081 bytes on disk; yt-dlp recorded format id bytevc1_1080p_577978-1, and the container carries TikTok's own tags comment=vid:v12300gd0001dbb9hbfog65hscusn5u0 and vid_md5=71ca67d98f01242688d63707784c4fea, with no aigc_info field present at all, so TikTok's AI-generated-content label is absent rather than set to zero. The extracted audio.mp3 runs 24.293878 s at 91,632 bps for 278,264 bytes under a different encoder tag, Lavf61.7.100. Posted at epoch 1792448685, which is 2026-10-19T22:24:45Z and 17:24:45 CDT, by handle chase_ai_ (uploader id 7334112384573096990, nickname "Chase AI"), with audio credited as track "original sound" by artist "Chase AI" rather than to any library track. The description is the 20-character, four-word string "claude hacks your TV", identical to the title, carrying no hashtags and no emoji. At capture time, which the embedded epoch field puts at 1792472473 or 2026-10-20T05:01:13Z and the metadata.json mtime puts at 2026-10-20 00:01:14 CDT, the counters read 444,500 views, 31,500 likes, 393 comments, 4,128 reposts and 15,569 saves. Twelve frames were extracted at fps=0.5, one per 2 s, covering 0 through 22 s, and I read seven of them: 001, 003, 005, 008, 009, 010 and 012, at 0, 4, 8, 14, 16, 18 and 22 seconds. Because the on-screen prompt card is the entire payload of this video and the burned-in captions sit directly over it, I re-extracted at fps=2 into 49 dense_*.jpg frames and additionally read dense_038 at 18.5 s and dense_044 at 21.5 s. The frames show a screen recording of X composited above a talking-head webcam shot of a bearded man in a grey quarter-zip at a desk microphone, in front of a city-skyline print and a plush figure. From 0 s to roughly 15 s the top pane holds one post by Mihir Gupta (@0900mihir, blue check) whose URL bar reads x.com/0900mihir/status/2111746030228455883, timestamped on screen as "4:07 AM, Oct 18, 2026", carrying a BEFORE/AFTER image captioned "Sponsored hero ad, 192 MB launcher" against "Clean dock, rotating wallpapers, 83 MB". At 16 s frame 009 opens that image full-bleed at /photo/1 and exposes the post's own counters, 188 replies, 246 reposts, 7.8K likes and 570K views. From roughly 17 s to the end the pane holds a second Gupta post dated Oct 18 containing the full reusable prompt, transcribed verbatim in a section below. The GitHub link card attached to that second post is occluded by the captions in every frame at both sampling rates and never resolves past "mihirgupta0900/tv", so I resolved it independently through the GitHub API. The transcript holds 88 words across 7 segments and the last segment ends at 23.86 s against a video audio stream of 24.264898 s and an extracted audio.mp3 of 24.293878 s, so every segment closes inside real audio and no segment runs past the end; this transcript carries no past-the-end Whisper hallucination.

"Can now" is wrong twice over: Claude Code has no TV tool, and ADB over Wi-Fi predates Claude Code by about fifteen years

The video's first sentence is "Claude Code can now hack your TV." Both halves of that fail.

There is no new capability. Anthropic's tools reference for Claude Code lists 45 built-in tools: Agent, Artifact, AskUserQuestion, Bash, CronCreate, CronDelete, CronList, Edit, EndConversation, EnterPlanMode, EnterWorktree, ExitPlanMode, ExitWorktree, Glob, Grep, ListAgents, ListMcpResourcesTool, LSP, Monitor, NotebookEdit, PowerShell, PushNotification, Read, ReadMcpResourceTool, RemoteTrigger, ReportFindings, ScheduleWakeup, SendFeedback, SendMessage, SendUserFile, ShareOnboardingGuide, Skill, SubagentHandback, TaskCreate, TaskGet, TaskList, TaskOutput, TaskStop, TaskUpdate, TodoWrite, ToolSearch, WaitForMcpServers, WebFetch, WebSearch, Workflow and Write. The strings "adb", "android" and "television" appear zero times across that entire reference page. The tool doing the work here is Bash, whose one-line description in Anthropic's own table is "Executes shell commands in your environment." That tool has been there the whole time. Running adb is the same category of act as running git or curl.

The access method is older still. Android's own adb documentation describes adb tcpip 5555 and adb connect <device_ip>:5555 as the path for devices running Android 10 or lower, and 5555 has been the default ADB-over-TCP port for about fifteen years. Mihir Gupta's tools/find-tv.sh confirms which port is in play; its header comment reads "scans the local /24 for ADB (5555) and Cast (8008)". Nothing about port 5555 changed in October 2026. What changed is that a few people filmed themselves pointing an agent at it.

The word "hack" is also doing work it has not earned. There is no vulnerability, no exploit and no privilege escalation. The owner walks to the TV, turns on a documented developer setting, and then physically approves a specific computer's RSA key on screen. Android's documentation is explicit about why that dialog exists: "this security mechanism protects user devices because it ensures that USB debugging and other adb commands cannot be executed unless you're able to unlock the device and acknowledge the dialog." That is authorized configuration of your own hardware.

"Simply pointing Claude Code at their TV on their Wi-Fi" skips four prerequisites, one of which needs the remote in your hand

At 8.54 s the narrator says people are "doing it by simply pointing Claude Code at their TV on their Wi-Fi," and at 18.62 s the only precondition he names is "just make sure you're on the same Wi-Fi network." The prompt card he is showing on screen at that exact moment contradicts him. Transcribed verbatim from frames 010, dense_038 and dense_044, Gupta's post reads:

Lots of you asked for the prompt, so here it is

On the TV: Settings → About → tap "Build" 7 times → Developer options → turn on USB debugging

Open Claude Code on a laptop on the same Wi-Fi and paste:

"My Android TV is slow and full of ads. Find it on my Wi-Fi, connect over ADB, and debloat it: disable the manufacturer's ads, telemetry and junk (reversibly, never uninstall), asking me first about apps and features I might use. Then build and install a fast, minimal Apple TV-style home screen with a dock of my favourite apps and rotating nature wallpapers. Back up before changing anything, check every step with screenshots from the TV, and give me a restore script."

Nothing gets uninstalled. It backs everything up first and gives you a restore script, so you can always go back to stock.

Launcher, scripts and wallpapers are open source:

So step one, before Claude Code is opened at all, is a four-stage manual walk through the TV's settings menu with the remote. The repository README at github.com/mihirgupta0900/tv-home spells the path out slightly longer than the tweet does, as "Settings → System → About → press OK on Build 7 times → back → Developer options → turn on USB debugging," and then adds a step the tweet omits entirely. README step 3 is: "Accept 'Allow USB debugging?' on the TV when asked." That is a modal dialog on the television that a person has to walk over and approve with the remote. An agent on a laptop cannot click it.

There is a real subtlety about why no USB cable appears anywhere in these instructions, and it is worth stating because Android's documentation does not lead with it. Android's adb page gives two routes. The modern route is Wireless debugging with a QR code or pairing code, and the page conditions it on "Android 11+ (API 30+) for phones; Android 13+ (API 33+) for TV/WearOS." Gupta's README records the tested device as "TCL Google TV (Android 11)," which is below that API 33 bar, so the pairing-code flow was not available to him. The legacy route in Android's docs requires an initial USB connection to issue adb tcpip 5555. Neither matches what these instructions describe. The resolution is an Android TV platform behavior rather than a phone one: on many Android TV and Google TV sets, flipping the single developer-options debugging toggle opens the network ADB listener directly, with no cable. It's FOSS states this plainly, noting that on some sets, Xiaomi among them, USB debugging alone "opens network ADB on port 5555." That is the undocumented-in-the-headline step that makes the whole workflow possible, and it is also the step that creates the exposure discussed below.

Nothing is "gotten rid of": the scripts run `pm disable-user --user 0`, which frees no storage and does not survive a factory reset

The narrator says at 4.72 s that people are "getting rid of all the bloatware," and closes at 20.32 s with "you can start getting rid of all that bloatware." The source material he is displaying says the opposite on its face. Gupta's own prompt, visible in the frame while he speaks, instructs the agent to work "(reversibly, never uninstall)," and the post text immediately below it begins "Nothing gets uninstalled."

The repository confirms this at the command level. tools/disable.sh carries the header comment "Packages are disabled for user 0, never uninstalled," and its one operative line pipes the debloat list through awk '{print "pm disable-user --user 0 " $1}'. That is pm disable-user, not pm uninstall. The distinction matters for three reasons. Disabling leaves the APK in place on the system partition, so no storage is reclaimed. Disabling is undone by a single re-enable call, which is what tools/restore.sh does. And pm disable-user does not survive a factory reset, where the better-known pm uninstall --user 0 idiom does survive a reboot but also reinstates the app after a reset, because the APK never left /system in either case.

The scope is also smaller than "all the bloatware" suggests. The debloat list the project ships for the tested set, examples/tcl-google-tv-g07/debloat.txt, contains exactly 25 package lines, which is where the "25 bloat apps disabled" figure in Gupta's post comes from. They are overwhelmingly TCL's own first-party promotional and telemetry packages: com.tcl.ttvs (annotated in the file as "TCL core service: BI analytics, Alexa bridge, account sync"), com.tcl.messagebox ("TCL promo message popups"), com.tcl.esticker ("on-screen promo stickers"), com.tcl.partnercustomizer ("partner app rows / promos for the stock launcher"), com.tcl.channelplus, com.tcl.waterfall.overseas ("the 'TCL' content tab"), com.tcl.hotelmenu and similar. The list is per-model and hand-curated. It is not a general solvent.

One package on the list is disabled for a functional reason rather than an advertising one, and the README flags it as a gotcha: com.google.android.tungsten.setupwraith. With the stock launcher disabled, that setup app "has a higher HOME priority than any third-party launcher," so the Home button stops reaching the new launcher until it is disabled too. That is the kind of detail that decides whether this ends with a working television.

The video credits the wrong originator: Gupta posted about 36 hours and seven posts into a trend his own README credits to someone else

The video shows exactly one person's posts and frames them as the event. X status IDs are Snowflake identifiers with an embedded millisecond timestamp, so the order is recoverable exactly rather than argued about. Decoding the IDs against X's epoch of 1288834974657 ms gives this sequence:

Decoded time (UTC)	Account	Post
2026-10-16 20:44:47	Ryan Doyle (@doooyle)	"Hacked my TV with Claude Code today"
2026-10-17 00:07:14	Ryan Doyle (@doooyle)	"This is how fast the TV moves now"
2026-10-17 08:51:31	Gathin (@gathint)	"Vibe coded my parents' TV this afternoon"
2026-10-17 10:02:20	Vaibhav Sisinty	"This guy hacked his own TV using Claude Code"
2026-10-17 22:59:41	0xProbability	"I just vibe-coded my TV"
2026-10-17 23:10:48	Muzzammil (@DevMuzzammil)	"the great debloating ... revolution has begun"
2026-10-18 09:07:42	Mihir Gupta (@0900mihir)	"Saw people vibe coding their TVs"

Gupta's post, the only one in the video, lands about 36 hours and seven posts after Ryan Doyle's. Its own first five words are "Saw people vibe coding their TVs," which is Gupta telling you he is a follower. His README closes with a Credits section reading "Inspired by [Gathin23/tv-vibehack]." The GitHub API puts Gathin's repository at created_at 2026-10-17T08:12:35Z, 39 minutes before Gathin's tweet, against 2026-10-18T20:12:18Z for mihirgupta0900/tv-home, a gap of about 36 hours that matches the tweet gap. Star counts at the time of this writing are 6,487 for Gathin's repository against 220 for Gupta's, a factor of about 29.

TechCrunch's 19 October 2026 piece by Sarah Perez names Gathin T. (@gathint) behind "cleanyourtv," Muzzammil Yasin Sabuwala (@DevMuzzammil) behind "dumbtv," Ryan Doyle (@doooyle), and Mihir Gupta (@0900mihir) as having "tested the approach independently." It's FOSS, also dated 19 October 2026, credits Ryan Doyle with initiating the trend. The two outlets differ on whether Doyle or Gathin deserves the origin credit; the Snowflake decode settles it in Doyle's favour by about twelve hours. Neither outlet, and neither reading, puts Gupta first.

One date in the video does check out, and it is a useful internal consistency test. The X interface in frame 001 renders Gupta's post as "4:07 AM, Oct 18, 2026," and X renders timestamps in the viewer's local timezone. The Snowflake decode gives 09:07:42 UTC, which is 04:07 CDT. The screen recording was therefore made in US Central time, consistent with the 17:24:45 CDT upload stamp on the TikTok itself.

"Infinitely faster" is unmeasured, and the only published number is a memory footprint rather than a speed

At 13.06 s the narrator says the technique makes a TV "run infinitely faster." That claim is unfalsifiable as stated and nothing in the source material supports it.

Trace the numbers to their origin and only one survives. Gupta's post says "the 192 MB stock launcher replaced with a custom 83 MB one," and the README repeats it as "cut the home screen's memory use from 192 MB to 83 MB" on "a 2 GB TCL Google TV." That is a resident memory figure for one process on one television, roughly a 57 percent reduction, measured once by the author with no methodology published. It is not a frame rate, a launch latency, an input-lag measurement or a benchmark. A smaller launcher on a 2 GB device plausibly leaves more headroom and reduces paging pressure, and the subjective result people are filming is consistent with that, but "memory footprint fell 57 percent" and "runs infinitely faster" are not the same claim and only the first one has a number behind it.

The repository itself is more careful than the video. It describes delivering a "fast" home screen and publishes no quantitative performance metric beyond the memory figure. I am labelling the speed claim Unverified rather than restating it.

The BEFORE/AFTER image in frames 001 through 009 is worth reading for what it actually demonstrates, which is an advertising change rather than a performance one. The BEFORE panel is a Google TV home screen dominated by a full-bleed sponsored hero tile for the film "Bajirao Mastani," with app rows including Netflix, YouTube, SonyLIV, prime video, ZEE5, a TCL tab and JioHotstar, an app mix that places the device in the Indian market. The AFTER panel is a clock reading 13:56 over a mountain-and-lake wallpaper with a five-app dock. The visible difference is the removal of a sponsored placement. That is a real and desirable outcome. It is a different outcome from speed.

The honest cost is an ADB listener left open on your LAN and an agent whose shell is unsandboxed by default

This is the part the video does not mention at all, and it is the part that deserves the most care. Two separate exposures stack here.

The first is the television. Once the developer-options debugging toggle is on, that set is listening for ADB on TCP 5555 for every device on the network, and it stays listening until someone turns it back off. Android's documentation is direct that the access point matters: "Beware that not all access points are suitable. You might need to use an access point whose firewall is configured properly to support adb." The protection on a modern set is the RSA key authorization dialog described above, which means a stranger on your Wi-Fi cannot silently execute commands, because they would need you to approve their key on the screen. That protection is real, and it is also narrower than it sounds. The dialog offers "always allow from this computer," and once a key is trusted it stays trusted until debugging authorizations are revoked. The port also remains open and discoverable to anything on the LAN, including a compromised laptop or IoT device that already holds a trusted key. It's FOSS gives the correct operational advice and the video gives none: "turn off USB or wireless debugging when you are done," specifically to avoid leaving "an open ADB port sitting on your home network." Nothing in the TikTok, and nothing in Gupta's prompt, tells you to close it afterwards.

The second exposure is the agent. Anthropic's own sandboxing documentation states the default plainly: "The sandbox is off by default." When it is switched on, the network table entry reads "No direct route out. Connections go through a proxy on your machine that checks each host against your allowed domains, which start empty." Read that in reverse and the default position is clear. An out-of-the-box Claude Code session running Bash has unrestricted access to every host on your local network, which is precisely the property that lets tools/find-tv.sh sweep a /24 for open ADB and Cast ports in the first place. The capability that makes this workflow convenient is the same capability that makes it worth thinking about. For a reader who wants the convenience without the blanket, the lever is sandbox.enabled in ~/.claude/settings.json plus a network.allowedDomains entry, documented on the same page.

Taken together: you are opening an unencrypted remote shell on a television, handing an autonomous agent a trusted key to it, granting that agent LAN-wide reach by default, and in most retellings of this trend never being told to close the door. The technique is legitimate and the project is careful, with backups, reversible disable-user calls and a restore script. The 24-second version of it is not careful, and "just make sure you're on the same Wi-Fi network" is the whole of its safety guidance.

Key Takeaways

Correction: "Claude Code can now hack your TV" is wrong on "now." Anthropic's tools reference lists 45 built-in tools with zero occurrences of "adb", "android" or "television"; the tool in use is Bash, described as "Executes shell commands in your environment," and it predates this trend. No TV-related capability shipped.
Correction: The mechanism is ADB over TCP port 5555, the default documented in Android's own adb page and confirmed by the project's tools/find-tv.sh header. Android has exposed this interface for about fifteen years. Nothing about it changed in October 2026.
Correction: The video credits the wrong person. Decoding X Snowflake IDs puts Ryan Doyle (@doooyle) first at 2026-10-16 20:44:47 UTC and Mihir Gupta, the only account the video shows, seventh at 2026-10-18 09:07:42 UTC, about 36 hours later. Gupta's own post opens "Saw people vibe coding their TVs" and his README credits Gathin23/tv-vibehack.
Correction: "Getting rid of all that bloatware" misstates what happens. tools/disable.sh runs pm disable-user --user 0. Packages are disabled, never uninstalled; no storage is freed, the change is reversible with tools/restore.sh, and it does not survive a factory reset.
Correction: "Simply pointing Claude Code at their TV on their Wi-Fi" omits the prerequisites printed on the card shown in the same frame. Developer options must be unlocked by tapping Build seven times, USB debugging must be turned on with the remote, and the README's step 3 requires physically accepting an "Allow USB debugging?" dialog on the television itself.
Unverified: "Run infinitely faster." No benchmark, frame rate or latency figure exists in any source. The single published number is one launcher's resident memory on one 2 GB TCL Google TV falling from 192 MB to 83 MB, roughly 57 percent, measured once with no stated methodology. The repository claims only a "fast" home screen.
Verified: "25 bloat apps disabled" checks out exactly. examples/tcl-google-tv-g07/debloat.txt contains precisely 25 package lines, almost all TCL first-party promo and telemetry packages such as com.tcl.ttvs, com.tcl.messagebox and com.tcl.esticker.
Verified: The prompt shown on screen is real and I transcribed it verbatim from frames 010, dense_038 and dense_044. It matches the text in the repository's README character for character, including the instruction "(reversibly, never uninstall)" that contradicts the narration over it.
Clarification: "Hack" overstates it. There is no exploit. Android's documentation describes the RSA authorization dialog as ensuring "adb commands cannot be executed unless you're able to unlock the device and acknowledge the dialog." This is authorized reconfiguration of hardware you own.
Clarification: Android's docs condition the Wireless debugging pairing-code flow on API 33+ for TV, and the tested set runs Android 11. The flow works anyway because many Android TV sets open the network ADB listener on the single USB-debugging toggle with no cable, which Android's phone-oriented documentation does not foreground.
Context: The security cost goes unmentioned in the video. The TV keeps listening on 5555 until debugging is turned back off, and Anthropic's own documentation states "The sandbox is off by default," meaning a stock Claude Code session has unrestricted LAN reach from Bash. It's FOSS advises turning debugging off when finished; the TikTok's only safety note is "just make sure you're on the same Wi-Fi network."
Context: Scope limit worth knowing before anyone tries this. The README supports Android TV and Google TV only, naming TCL, Xiaomi/Redmi, Hisense, Sony, OnePlus, Realme, Nvidia Shield and Chromecast with Google TV, and explicitly excludes Samsung (Tizen), LG (webOS) and Fire TV.
Context: "Taking over Twitter right now" is fair as virality. The embedded post showed 570K views, 7.8K likes, 246 reposts and 188 replies at recording time, and Gathin's repository stands at 6,487 stars against 220 for Gupta's.

Resources

mihirgupta0900/tv-home README establishes the full prompt text shown in the video, the four-step developer-options prerequisite, the "Accept 'Allow USB debugging?' on the TV" step the tweet omits, the 192 MB to 83 MB memory figure, the tested device as "TCL Google TV (Android 11)", the com.google.android.tungsten.setupwraith Home-button gotcha, the supported and excluded TV platforms, and the "Inspired by Gathin23/tv-vibehack" credit.
tools/disable.sh, mihirgupta0900/tv-home establishes the actual command as pm disable-user --user 0 and carries the comment "Packages are disabled for user 0, never uninstalled."
tools/find-tv.sh, mihirgupta0900/tv-home establishes port 5555 as the ADB port being scanned, via its header "scans the local /24 for ADB (5555) and Cast (8008)."
examples/tcl-google-tv-g07/debloat.txt establishes the exact count of 25 packages and their identities as TCL first-party promo and telemetry components.
GitHub API, mihirgupta0900/tv-home and GitHub API, Gathin23/cleanyourtv establish repository creation at 2026-10-18T20:12:18Z and 2026-10-17T08:12:35Z respectively, and star counts of 220 and 6,487, confirming Gathin's project predates Gupta's by about 36 hours.
Android Debug Bridge (adb), Android Developers establishes 5555 as the default ADB-over-TCP port, the Android 10-and-lower adb tcpip plus adb connect flow and its USB prerequisite, the API 30+ phone and API 33+ TV/WearOS requirement for pairing-code Wireless debugging, the RSA key authorization dialog as the actual access control, and the warning that "not all access points are suitable."
Tools reference, Claude Code documentation establishes the complete 45-tool list, the Bash description "Executes shell commands in your environment", and that no device, ADB, Android or TV tool exists. The strings "adb", "android" and "television" return zero matches on that page.
Configure the sandboxed Bash tool, Claude Code documentation establishes "The sandbox is off by default" and that when enabled, network access runs through a proxy against allowed domains that "start empty", which is what makes unrestricted LAN scanning the stock behavior.
People are using AI to make their smart TVs dumb again, TechCrunch, 19 October 2026 by Sarah Perez establishes the cast and their handles, dates Gathin's and Doyle's posts to 17 October and Muzzammil's to 18 October, describes Gupta as having tested the approach independently, and reports bricked devices and failed installs among the outcomes.
People Are Using AI to Get Rid of Smart TV Ads and Make Their TVs Faster, It's FOSS, 19 October 2026 establishes that some Android TV sets open network ADB on port 5555 from the USB-debugging toggle alone, credits Ryan Doyle with starting the trend, and supplies the operational warning to turn debugging off afterwards to avoid "an open ADB port sitting on your home network."
Gathin23/tv-vibehack README establishes the originating tweet link x.com/gathint/status/2111379569030939102 and the project's rename to cleanyourtv.
X posts doooyle/2111196679680540724, gathint/2111379569030939102 and 0900mihir/2111746030228455883 supply the Snowflake IDs decoded for the chronology table. The X pages themselves were not fetched; the IDs come from search result URLs and from the URL bar visible in frame 009, and the timestamps are computed arithmetically from the IDs against X's epoch of 1288834974657 ms, which is independently corroborated by the "4:07 AM, Oct 18, 2026" rendering on screen matching 09:07:42 UTC in US Central time.