OpenAI's ad collector bzr.openai.com creates a short-lived signed JWT tying a 22‑character identifier ("obi") to a ChatGPT account subject, then sets obi as a .openai.com cookie (SameSite=None, Secure, Max‑Age one year) via a cross‑site sync. When websites buy ads and install OpenAI's pixel/SDK, simply loading the SDK's script causes the browser to attach the obi cookie to requests before any OpenAI code runs, and subsequent SDK events POST the identifier plus scraped page data back to OpenAI. The SDK harvests advertiser-provided fields and scrapes dataLayer, form fields and page text (emails/phones/names are SHA‑256 hashed; location and path are sent in clear; query strings are dropped). The JWTs contain consent_decision: analytics_allowed, so users who permit analytics but refuse marketing still receive obi.
Reproduction on a mobile device and months of traffic monitoring showed obi sent from many advertiser pixels and hostnames (hundreds of pixels, over a thousand hostnames; examples include Chewy, Wayfair, HelloFresh). Decoded sync tokens included both account_user and persistent anonymous identifiers. Browsers with strict third‑party cookie controls (Safari/iOS) block the mechanism; Chrome on Android does not. OpenAI acknowledged the inquiry without substantive answers. The design enables resolving off‑site activity to a ChatGPT identity server‑side, a standard adtech join historically used by other platforms but notable when applied to an AI chat product.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Google AI Studio's data deletion practices are questioned due to a CWE-459 vulnerability and evidence of data retention, according to AI Weekly. Industry experts express concerns over backend data hoarding and UI misrepresentation. (bitu79.substack.com)
Flock partnered with a nonprofit accused of using AI to create fake grassroots support for its surveillance cameras. Critics argue the campaign manipulates public opinion and raises privacy concerns. (theintercept.com)
Sports betting apps like FanDuel and DraftKings are being sued for being designed to create addiction, similar to the effects of crack cocaine in the 1980s. Attorneys argue that these apps cause financial and personal devastation for users, with some losing their homes and families. (cbsnews.com)
The Snowden Archive is a collection of documents and information leaked by NSA whistleblower Edward Snowden. Its current status and accessibility have become topics of discussion and concern. (libroot.org)
OpenAI's CEO Sam Altman is scheduled to brief the UN Security Council next week. The meeting will focus on AI-related topics and global security concerns. (reuters.com)
A cybersecurity expert successfully hacked a BYD Shark 6 hybrid ute, demonstrating how easily the vehicle could be remotely controlled. The hack highlights vulnerabilities in connected cars, especially those controlled by software from Chinese manufacturers. (abc.net.au)
Today's best Hacker News stories, summarized and screenshotted, one email a day.