San FranciscoOpenAI’s ad cookie ties ChatGPT accounts to advertiser websites.
OpenAI can connect what users do on those sites to their ChatGPT account, the researcher found.
The browser attaches the __obi cookie when loading an advertiser’s OpenAI script, before any OpenAI code runs.
The signed token expires in 60 seconds, but the cookie it sets lasts a year.
The researcher logged 936 advertiser pixels across 1,029 hostnames over several months.
How each outlet framed it
- Hacker News leans critical
- reverse-engineers __obi cookie mechanism with JWT auth; verifies tracking across 936 advertiser pixels on 1,029 hostnames
Sources: Hacker News