OpenAI's __obi ad tracker links your off-site browsing to your ChatGPT account
emax · x · 2026-09-21
A reverse-engineering writeup details OpenAI's ad collector at bzr.openai.com: ChatGPT generates an identifier (obi), the backend signs an RS256 JWT binding it to your account (60s expiry), and it lands as an obi cookie scoped to .openai.com.
Advertisers buying ChatGPT ads install OpenAI code on their sites (like Meta/Google pixels), which sends obi plus page data — products searched, articles read, purchase behavior — back to OpenAI, linking off-site activity to your ChatGPT account.
The author reproduced the full mechanism on his own phone with two independent capture methods, cross-checked over months of traffic covering 936 advertiser pixels across 1,029 hostnames. Bottom line: AI apps now need ad-blockers.
Related event: ChatGPT Accused of Cross-Site Tracking via __obi Cookie(3 posts)→
More from Safety
- Senate Bill Would Force Big Platforms to Accept AI Agents, Raising Auth Privacy Questions — Prof_CarlaReyes · 2026-11-12
- United Airlines Bans AI Agents From Booking Flights Over Data and Legal Risks — rohanpaul_ai · 2026-11-12
- Stanford HAI blueprint: 56 US agencies report 3,611 AI use cases, evaluation lags — StanfordHAI · 2026-11-12
- Focused task framing boosts agent boundary testing by ~60 points; VM escape still fails — perplexity_ai · 2026-11-12
- Perplexity red-teams its SPACE VM sandbox: CTF prompts mislead agent security testing — perplexity_ai · 2026-11-12
- Narayanan: blanket bans on teen AI companions are bad policy; incentivize pro-social design instead — random_walker · 2026-11-12