Daily Vibe - 10-21-26 · Vibe Coders

12d • News

Daily Vibe - 10-21-26

Good news if you've been staring down a TV that shows you an ad before it even lets you open Netflix: the fix might be a free AI agent and an afternoon. Bad news if you're into robots that text your friends by accident — more on that below.

The lead story: people are vibe coding the ads out of their TVs

A developer named Gathin T. got tired of his parents' Xiaomi TV shoving a sponsored ad in front of them before Netflix would even load. So he pointed Claude Code at the TV over Wi-Fi and let it work. The agent found the set, switched off 25 Xiaomi software packages, and built a new home screen that, in his words, "looks like an Apple TV now lol."

He turned the process into an open-source project called cleanyourtv. As of Tuesday it had tested setups for 107 TV models across 37 brands, 10,700 GitHub stars, 1,200 forks, and 85 open pull requests. It works through Android's built-in debugging bridge (ADB), the same maintenance tool Android phones use, so nothing gets deleted — apps just get switched off, and a one-line script restores everything if you change your mind.

Other people ran with it. Mihir Gupta swapped a 192 MB stock launcher for a custom 83 MB one. Ansub Khan said his parents' old Android TV got about 90% more free memory. Ryan Doyle sent Claude a product listing and asked "can you hack this?" and ended up with a screensaver tracking his Stripe payments. A separate project called dumbtv does the same job on Amazon Fire TV, killing about 65 packages — including the ad-tracking software — and replacing the launcher with a 41 KB app that has no internet permission at all.

This isn't just a fun hack. Texas sued Sony, Samsung, LG, Hisense, and TCL in December 2025, alleging their TVs can screenshot your display every 500 milliseconds to feed ad targeting. Vizio already paid $2.2 million to the FTC back in 2017 for pulling viewing data from 11 million TVs without consent — and that didn't stop Walmart from buying Vizio for about $2.3 billion in 2024, partly for its ad business. The incentives for manufacturers to bloat your TV with ads aren't going away. The incentive to vibe-code your way out of it just got a lot more practical.

A few cautions worth repeating before you try this on your own TV: the readme for cleanyourtv warns that network ADB is unencrypted, and on some firmware anyone on your Wi-Fi can take control once debugging is on — turn it off when you're done. Not everyone made it out clean either; one person bricked their TV, another got stuck mid-job on a Fire TV. And Anthropic patched a Claude Code flaw back in May that let hidden instructions expose credentials, so "AI agent with terminal access on your home network" is still something to take seriously, not just something to screenshot for X.

[YOUR TAKE: have you pointed Claude Code or Cursor at a device that wasn't supposed to be hackable? how'd it go?]

Quick hits

Your home MCP server is probably more exposed than you think. OX Security scanned 15,465 publicly indexed MCP servers and found about 0.45% running on personal or home machines, often reachable through consumer tunneling tools like ngrok. The underlying issue is architectural: Anthropic's official MCP SDKs use a transport method that executes commands without sanitizing them, and Anthropic has confirmed that's by design, leaving sanitization up to developers. A related npm package flaw (CVE-2025-6514) scored a 9.6 out of 10 on severity with a 77% chance of exploitation within 30 days, per the CVE's EPSS score. If you've got an MCP server running at home for a side project, treat it like anything else exposed to the internet: assume it's being scanned, and kill the tunnel if you don't need it on. Read more.

Five GitHub repos are trying to turn "explain the process every time" into "install it once." KDnuggets rounded up the biggest agent-skills collections for Claude Code, Codex, Cursor, and friends: Superpowers (285.5K stars) bakes in a full dev methodology — brainstorm, plan, TDD, debug, review, verify. Matt Pocock's Skills for Real Engineers (260.1K stars) is more modular, with skills like tdd and diagnosing-bugs you mix into your own flow. ECC (256.7K stars) goes further with 292 skills, 68 specialized agents, and cross-session memory. If you're tired of re-explaining your workflow to your agent every single session, this is worth a browse. Read more.

A reviewer tried to build a free J.A.R.V.I.S. and got a mixed report card. Techloy ran OpenClaw — a free, self-hosted agent that chats over WhatsApp or Telegram — for nine days on $0, using a free Gemini API key. Memory held up across restarts, and one morning it handled 20 prompt tasks back to back with zero errors. But it also got things about itself wrong six times in nine days, including claiming it set a reminder that never fired, and it auto-replied to one of the reviewer's contacts on WhatsApp with a raw pairing code. A planted prompt-injection test got partially through: the agent created the file it was told to make, though it stayed empty. Read more.

[YOUR TAKE: if you're running a self-hosted agent on messaging apps, what guardrails do you actually trust?]

What this means for you

If your TV is running Android TV or Google TV, debloating it is now a documented, reversible process — check cleanyourtv's list of 107 tested models before you start from scratch.
Turn off network debugging (ADB) and any tunnels the moment you're done. An open door for your agent is an open door for everyone else on your Wi-Fi too.
If you're running any MCP server, even a toy one for a side project, don't assume the protocol protects you — check what's actually reachable from outside your home network.
Before you build another custom agent workflow from scratch, skim the existing skills repos. Someone's probably already written the debugging or test-driven-development process you keep re-explaining.

What's the weirdest piece of hardware you'd point an AI agent at next? Drop it in the thread.

Sources