OpenAI's __obi ad tracker links your off-site browsing to your ChatGPT account
emax · x · 2026-09-21
A reverse-engineering writeup details OpenAI's ad collector at bzr.openai.com: ChatGPT generates an identifier (obi), the backend signs an RS256 JWT binding it to your account (60s expiry), and it lands as an obi cookie scoped to .openai.com.
Advertisers buying ChatGPT ads install OpenAI code on their sites (like Meta/Google pixels), which sends obi plus page data — products searched, articles read, purchase behavior — back to OpenAI, linking off-site activity to your ChatGPT account.
The author reproduced the full mechanism on his own phone with two independent capture methods, cross-checked over months of traffic covering 936 advertiser pixels across 1,029 hostnames. Bottom line: AI apps now need ad-blockers.
More from Safety
- Consumer Claude now serves California agencies, and complaints reportedly exploded — menhguin · 2026-09-21
- China releases first-round post-quantum crypto candidates across three algorithm categories — matthew_d_green · 2026-09-21
- Gemma 4 fell for 3/4 prompt injection traps and ran a shell command; Qwen 3.8 mostly didn't — divinetribe1 · 2026-09-21
- Two Amazon drones hit the same crane: SAA failure raises hard reliability questions — TinfoilTricorn · 2026-09-21
- LessWrong Essay Argues the 'Corrigibility Basin of Attraction' Is a Misleading Gloss — JacquesThibs · 2026-09-21
- HN debate: Frontier labs accused of overselling AI capabilities to Washington — nr378 · 2026-09-21