Loading story…
OpenAI’s advertising-measurement infrastructure reportedly sets a cross-site __obi cookie through its bzr.openai.com collector, enabling activity on advertiser sites to be associated with a ChatGPT account or a persistent anonymous device identifier. The one-year cookie is configured with Secure and SameSite=None; advertiser pixels can reportedly transmit page paths, purchase-funnel activity, and conversion events to OpenAI.
Researchers observed the mechanism in 936 pixels across 1,029 hostnames and said advertiser pages or data layers could expose identity and location fields. The reported implementation activated under analytics consent even where marketing consent was denied, creating potential consent-management and data-classification concerns; it was observed primarily in Chrome on Android, while Safari and other iOS WebKit browsers are expected to limit the approach through Intelligent Tracking Prevention.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers reported that OpenAI's advertising-measurement system sets a Secure, SameSite=None __obi cookie via bzr.openai.com, allowing advertiser-site pixel requests to associate browsing and conversion activity with ChatGPT account-linked or device-linked identifiers. The mechanism was independently reproduced on mobile devices and observed across 936 pixels on 1,029 hostnames; OpenAI acknowledged a privacy inquiry without a detailed response on classification or consent behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two separate developments highlighted growing security and privacy concerns around consumer AI chatbots as the industry shifts toward ad-driven monetization. **Moxie Marlinspike** (Signal founder) launched *Confer*, positioned as an “end-to-end encryption for AI chats” tool intended to keep user conversations private—claiming the service cannot read chats, store them, or use them for model training because only the user can access the plaintext. The reporting frames *Confer* as a response to increasing workplace and consumer leakage of sensitive data into AI assistants and broader concerns that AI platforms will monetize user data. In parallel, commentary warned that major AI providers are increasingly adopting the social-media model of **behavioral data collection and advertising**, raising the risk of user manipulation and erosion of trust. The piece cites OpenAI’s expansion into search and browsing features and notes OpenAI’s announcement that it will begin testing ads in the free version of **ChatGPT**, alongside similar ad experiments by other AI products (e.g., Perplexity, Microsoft Copilot, Google’s AI search experiences, and Amazon’s chatbot). The core security implication is that ad incentives can drive more tracking and persuasive optimization in AI responses, increasing privacy exposure and the potential for covert influence over user decisions.
Jun 29, 2026
Researchers reported that a fake Chrome extension called **"ChatGPT Ad Blocker"** posed as a tool to remove ads from ChatGPT while secretly harvesting users' prompts and responses. The extension reportedly cloned the ChatGPT page DOM, extracted conversation text, and exfiltrated chats longer than 150 characters to a private Discord channel using a bot identified as **Captain Hook**, turning a supposed privacy tool into a straightforward data-theft mechanism. The campaign appears to have capitalized on interest around ChatGPT advertising by luring users with bogus ad-blocking functionality. DomainTools linked the operation to suspicious domains including `blockaiads.com`, `openadblock.com`, and `gptadblock.com`, and found the extension checked a GitHub-hosted file hourly for remote instructions, suggesting active attacker control and the ability to update behavior over time. The developer account was reportedly tied to the handle **`krittinkalra`** and associated with AI platforms Writecream and AI4ChatCo, although no evidence was cited that those other apps also stole data.
Jun 29, 2026
Researchers and vendors have disclosed serious security weaknesses in AI-enabled browsers, warning that agentic features can undermine core browser protections such as the same-origin policy, tab isolation, and safe handling of cross-origin content. A study cited by *Live Science* found inconsistent security behavior across seven AI browsers and concluded that more capable products often introduced greater risk, including exposure through prompt injection, multi-tab visibility, and unsafe memory handling. Brave separately detailed indirect prompt injection risks in its discussion of Perplexity Comet, highlighting how malicious web content can manipulate browser agents through embedded instructions. A separate vulnerability chain in OpenAI’s ChatGPT Atlas browser showed how these design risks can translate into account-compromise scenarios. According to Hacktron AI, exposed Chromium Mojo IPC interfaces were reachable from broadly allowlisted OpenAI web origins, and researchers chained a `postMessage`-based XSS on `forums.openai.com` with a login CSRF flaw to execute JavaScript on an authenticated OpenAI domain. From there, they were able to control Atlas browser functions, enumerate and manipulate tabs, and continuously read live tab URLs, enabling theft of OAuth authorization codes that could lead to takeover of accounts such as GitHub, Reddit, and Facebook. OpenAI said it fixed the issue in Atlas version `1.2025.288.15` and awarded a $5,000 bounty.
Jul 24, 2026