Why LG Is Cracking Down on Proxy SDKs

LG Electronics announced this week it will suspend any smart TV apps that turn televisions into always-on residential proxy nodes. The move comes less than a month after researchers revealed that over 42 percent of games and utilities on LG’s webOS store let unknown third parties route internet traffic through users’ TVs.

Security firm Spur published findings in early July showing that residential proxy software development kits (SDKs) have quietly infiltrated smart TV platforms. For Samsung’s Tizen OS, more than a quarter of apps contained similar components. The data suggests a systemic problem, not an isolated incident.

What Are Residential Proxies Doing in Your TV?

Residential proxy networks pay app developers to embed SDKs that turn a device into a proxy node. Paying customers then rent that node to route their own traffic through it. In LG and Samsung smart TVs, Spur found these SDKs bundled with everything from Pac-Man clones to screensavers and file managers.

A Pac-Man app from Bright Data even offers users a choice: watch ads or let the TV serve as a proxy node. Bright Data, which accounted for the majority of proxy SDKs on both platforms, did not respond to requests for comment.

Bright Data and other providers claim they follow rigorous know-your-customer processes to prevent abuse. They also say they deploy countermeasures that stop proxy customers from interacting with other devices on the user’s local network. But critics argue that a one-time consent prompt buried in a TV app is not enough.

LG’s Response: Suspensions and Policy Changes

LG Senior Vice President John Taylor told KrebsOnSecurity that the company is working with developers to remove residential proxy options from their apps. Developers that fail to comply will see their apps suspended.

“A residential proxy network is not an intended use for LG smart TVs,” Taylor said. “LG Electronics is working with developers to remove the residential proxy option from their apps on the webOS platform. If this option is not removed, these apps will be suspended.”

Taylor added that the review is “well underway now.” LG will also strengthen its evaluation process for developer-submitted apps, including those that incorporate proxy SDKs.

The Deeper Problem: Consent and Awareness

Spur’s Trevor Sutter put it bluntly: “A one-time consent prompt buried in a TV app is not a substitute for meaningful transparency, ongoing control, and platform oversight. The risk is amplified when consent comes from individuals within the household who use the device but shouldn’t give consent, such as minors.”

Most consumers do not think of their smart TV as a computer. They don’t audit apps or check for background network activity. That makes residential proxies particularly insidious. The device sits in the living room, always on, always connected — an ideal node for someone who wants to hide their traffic behind a real residential IP address.

Spur’s report notes that the problem is not that residential proxy networks exist, but that they are being embedded at scale in devices that most people cannot easily monitor.

LG’s Other Controversy: McAfee Bloatware

LG’s announcement comes amid criticism over another partnership. This week, the YouTube channel Gamers Nexus showed that certain LG LCD monitors automatically install an app promoting paid McAfee antivirus subscriptions. The app arrives through Windows Update without any approval prompt. Users reported that the software drivers push McAfee promotions without consent, triggering frustration among gamers and professionals alike.

LG has not yet commented on the McAfee issue. But the combination of proxy SDKs in smart TVs and unwanted antivirus promotions in monitors suggests a pattern: LG is comfortable embedding third-party monetization in its hardware, often without clear user consent.

What This Means for LG Users

For now, LG’s crackdown on residential proxies is a positive step. Users should check which apps are installed on their webOS smart TVs and remove any they do not recognize. If an app offers a choice between ads and “network sharing,” the safest option is to uninstall it entirely.

The company says it will continue to review apps and enforce the ban. Whether that translates into real change — or just a temporary PR move — remains to be seen. But for the millions of LG smart TV owners, the message is clear: your television should not be a tool for strangers to hide their internet activity.

As Spur’s research showed, the problem extends beyond LG. Samsung has not announced any similar action for its Tizen platform. Consumers who want to avoid residential proxies altogether may need to look beyond the app store — or consider whether they need a smart TV at all.

Not Your Typical Hacker Story

Andreas Gaetje won’t pretend he spent his teenage years breaking into systems or writing exploits. He didn’t. The CISO at Körber AG came to cybersecurity from economics and business politics — a route that was unusual in the 1990s and still raises eyebrows today.

“I’m not the deepest bit-crawler,” Gaetje admits. “That’s just not who I am.” And yet, he now leads security for a global technology and manufacturing group with roughly 13,000 employees across 100 locations. Körber’s machines are behind much of the world’s pharmaceutical supply chain. “Probably every vaccine you ever received has been through our machines,” he notes.

His story is a useful counterpoint to the idea that you need to be a hardcore technical wizard to become a CISO. What you do need, Gaetje argues, is a deep understanding of business, the ability to learn constantly, and the trust of the people around you.

From Public Service Dreams to a Consulting Detour

Gaetje didn’t set out to work in security. In the mid-1990s, fresh out of university with a focus on economics and business politics, he expected to land a job in public services. But reality intervened. He needed money immediately, not someday.

The internet was just beginning to transform from an academic niche into a business necessity. Email was becoming the default communication tool. Gaetje made a pragmatic pivot: “I said to myself, Okay, let’s maybe do something in the computer business.”

He joined a consulting firm, hoping to blend his interest in business and technology. But by the early 2000s, he realized that to truly focus on business inside IT, he needed depth in a single sector. He chose finance. “The best industry at that point in time, where IT was really crucial, was the finance industry,” he recalls. He joined an insurance company as an auditor.

The Compliance Era That Changed Everything

Back then, cybersecurity wasn’t the existential business threat it is today. “ITsec and audit had a natural affinity,” Gaetje explains. “ITsec was primarily about compliance — it wasn’t yet the business threat it has since become.” His mix of business knowledge, IT understanding, and audit experience put him in the right place at the right time.

When cybersecurity began to explode as a discipline, he was asked to manage the growing information security function. The real turning point came in the 2010s, with attacks like WannaCry and NotPetya. “It was very clear: we weren’t talking about a simple compliance issue anymore. This was a serious business threat,” he says. “Cybersecurity had become a hot topic. It was complex, innovative, and really interesting to work in.”

By 2018, Gaetje was CISO at Körber IT Solutions. A year later, he took the top security role at the parent company, Körber AG.

Career Advice: Don’t Get Stuck in One SECTOR

Gaetje credits much of his growth to a single piece of advice: if you want to truly understand security, don’t stay too long in one company or one industry. Different sectors have different risk profiles. Stay in one place too long, and your thinking can get rigid. Attackers change fast. You need to be able to change how you think.

“It’s what made me move from the insurance industry into manufacturing and machine building,” he says. “I wanted to learn something else, to experience something new, and do something different.”

What Makes a Security Leader?

Gaetje is blunt about his own leadership style. “I’m not a born leader. I would never consider that,” he says. But he has a clear philosophy: a leader provides direction and a vision of what can be achieved and how. In any group, someone emerges as the de facto leader. The challenge is to justify that dominance with reliability and trust.

“It’s something you can learn,” he insists. “It’s not something that comes out of the blue. I learned and enhanced that learning with training courses. But of course, your personality is also important. You need to be reliable — you need to be a person that people trust, otherwise it just doesn’t work.”

Leadership, Gaetje believes, isn’t limited to formal management titles. “You’re a leader, even if it’s a thought leader driving and directing other people in a specific direction.”

Building a Security Team in a Talent Crisis

The cybersecurity skills gap is well documented — estimates in 2025 ranged from 2.8 million to 4.8 million unfilled positions globally. Gaetje has felt that pressure firsthand. “In recruiting your team, you have a wish list, and then you have reality — and unfortunately, they don’t always fit together,” he says.

But one requirement is non-negotiable: “I need people who want to learn.” The cybersecurity landscape shifts so fast that prior experience matters less than curiosity. “It’s incredible how fast things change. So, what I always need are people who are engaged, can think out of the box, and want to go the extra mile to understand what’s going on.”

Training and career development he can provide. But that initial spark of enthusiasm? That’s on the candidate. “So, whether I’m looking for an engineer, an analyst or some junior position, experience is good, but enthusiasm to learn is necessary.”

Would He Hire a Hacker?

“That depends,” Gaetje says. The hacker mentality — built-in curiosity and persistence — is valuable. But there are two types. “White hackers I would employ; blackhats, no.” He isn’t comfortable bringing someone with a history of malicious activity into Körber.

His advice to ambitious team members is simple: “Be curious. Things are really changing. If you think you know everything about anything, you’re wrong. That’s never true. There’s always something new coming for you to learn and experience.”

AI: The Double-Edged Sword That’s Reshaping Security

Gaetje’s biggest concern today isn’t a specific threat — it’s the sheer speed of technological change. “Just think about the many things you’ve learned in the last few weeks, about new developments, new products and new techniques that have been deployed to the public. AI is an example — we learn new things about the potential of generative AI and agentic AI every week. What used to occur over a period of two years or more now happens in a couple of weeks.”

AI presents a unique challenge because it’s used by both attackers and defenders. Attackers are using it to scale and sophisticate their operations. Defenders are fighting back with their own AI, but those defenses can be manipulated. Meanwhile, shadow AI — systems deployed without IT or security knowledge — is proliferating inside organizations.

“The pace of new technology is truly hard to manage,” Gaetje says. “For each new technology you must find time to learn and understand it — but that’s on top of everything else you’re already doing. And it’s not just you — everyone on your team must find time to understand the new technology, and you must personally motivate them to do so when they are already fully occupied.”

Will AI reduce the need for human security staff? Gaetje doesn’t think so. “I think the role of cybersecurity, and even my own role will be much more important in the future than it is today. But it may change.” As AI spreads across the business, security problems will become too widespread for the security team to handle alone. Other departments — product development, software engineering — will need to be brought into the fold.

The Risk of Losing Core Skills

Gaetje worries that AI could erode foundational skills, especially among programmers and SOC analysts. “AI coding assistants require prompt engineers and architects above programmers — and that can be a problem. How do you bring people from this level to the next level if they are not able to program on their own?”

A similar issue looms for security analysts. The standard view is that AI will collapse the SOC tier hierarchy — no more tier 1 analysts doing triage because AI will handle it. But Gaetje asks: “If the security analyst job can be done via an agentic AI tool, then how will analysts learn how to analyze an event? Maybe in the future, if we just rely on AI, we will lose the ability to see the tricky things in the incident.”

Still, he’s not pessimistic. “I’m pretty sure we will find different ways to handle the changes. And honestly, there’s so much out there that I’m not really concerned that we will lose anything.”

The real challenge, he says, is guiding the security team through this transition. “The job of the security team will change dramatically in the future. That’s my strong belief. The CISO challenge is to help team members along this road to a new level, where they are able to think out of the box to see what else they can bring to the job.”

For more insights from security leaders, check out our other CISO Conversations with Aimee Cardwell and Tarah Wheeler.

The Old Playbook Won’t Cut It

Most organizations treat AI agents like glorified service accounts. A few API tokens, some basic permissions, and off they go. That thinking is dangerously outdated.

AI agents aren’t just another type of software bot. They act, decide, and interact with systems in ways that static credentials never could. They learn. They adapt. They can even change their own behavior based on context. That makes them a fundamentally new kind of identity — one that existing identity and access management (IAM) systems weren’t built to handle.

If your company is still managing AI agents the same way it manages a cron job or a database user, you’re not just behind. You’re exposed.

What Makes AI Agents Different from Service Accounts

A service account has a fixed set of permissions. It does one thing, the same way, every time. An AI agent, by contrast, might request access to new data mid-task, generate content, or even execute commands it wasn’t explicitly programmed to run.

Consider a customer support agent powered by a large language model. It might need to read a ticket, query a CRM, draft a reply, and then update a database. That’s a chain of actions that requires dynamic, context-aware permissions — not a static API key.

And unlike a human employee, an AI agent can act at machine speed. It can make thousands of decisions per minute. If its identity is compromised or misconfigured, the blast radius is enormous.

The Three Core Problems with Current Approaches

Most organizations fall into one of three traps when handling AI agent identities:

• Over-permissioning: Giving agents broad access to avoid breaking workflows. This is the most common mistake — and the most dangerous. An agent with read-write access to your entire customer database is a liability waiting to happen.
• Static credentials: Using long-lived API tokens or service account passwords that never rotate. If an agent’s token leaks, an attacker can impersonate it indefinitely.
• No audit trail for agent actions: Logging what a human user did is standard practice. But many organizations don’t track what an AI agent actually did — which data it accessed, which commands it ran, which decisions it made. That’s a compliance nightmare.

What a Proper AI Agent Identity Model Looks Like

A few forward-thinking companies are starting to build a better model. Here’s what it includes:

1. Dynamic, Least-Privilege Permissions

Instead of giving an agent a fixed role, grant permissions based on the specific task at hand. The agent gets read access to a ticket, write access to a reply draft, and nothing more. Once the task is done, those permissions expire.

2. Short-Lived Credentials

No more API keys that last for months. Agents should authenticate using short-lived tokens — hours or minutes, not weeks. This limits the damage if a credential is stolen.

3. Behavioral Monitoring

Track what the agent actually does, not just what it’s allowed to do. If a customer support agent suddenly starts querying the HR database, that’s a red flag. Behavioral baselines and anomaly detection are essential.

4. Human-in-the-Loop for High-Risk Actions

Some actions are too risky to leave to an autonomous agent. Deleting records, transferring money, or changing permissions should require explicit human approval. The agent can request it — but it shouldn’t be able to execute it alone.

Why Most Organizations Aren’t Ready

The tools for managing AI agent identities barely exist. Most IAM platforms today were designed for humans and static services. They don’t understand agent behavior. They can’t enforce dynamic permissions. They don’t log agent decision chains.

And the pace of AI adoption is only accelerating. Companies are deploying agents for sales, support, code generation, and data analysis — often without involving the security or IAM teams at all. Shadow IT for AI agents is already a real problem.

According to recent reports, the number of non-human identities in enterprises is growing faster than human identities. And AI agents represent the most complex subset of those identities. Yet most organizations still treat them as an afterthought.

What Leaders Should Do Now

Start by auditing every AI agent in your environment. Ask three questions:

• What data can this agent access?
• What actions can this agent perform?
• Who — or what — approved those permissions?

If you can’t answer all three clearly, you have a problem.

Next, push your IAM vendor for AI-specific identity features. Ask about dynamic permission models, behavioral monitoring, and short-lived credential support. If they don’t have answers, consider alternatives.

Finally, treat AI agent identity as a identity governance priority — not a DevOps afterthought. The teams building and deploying these agents need to work hand-in-hand with security. That means clear policies, regular reviews, and the same rigor you apply to human access.

AI agents are here to stay. The question is whether your organization will manage them — or be managed by them.