[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-openai-obi-cookie-cross-site-tracking-chatgpt":3,"topics-all":35,"news-related-d569d88a-8906-4f3b-83fd-0dcc6b5c75e0":54},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":21,"news_slug":28,"published_at":29,"created_at":30,"modified_at":31,"is_published":32,"publish_type":33,"image_url":14,"view_count":34},"d569d88a-8906-4f3b-83fd-0dcc6b5c75e0","OpenAI 用 __obi 把 ChatGPT 账号绑上你全网浏览","安全研究者 Buchodi 复现 OpenAI 跨站追踪机制：ChatGPT 内置 __obi cookie，作用域 .openai.com、生命周期一年、登录时绑定账户，任何接入广告像素的网站都会把它连同浏览数据送回 OpenAI。","安全研究员 Jamie Larson（Buchodi）在自托管 Threat Intel 上发出一份完整复盘，记录下 OpenAI 是怎么通过内置在 bzr.openai.com 上的「广告收集器」拿到 ChatGPT 用户跨站行为画像的。机制并不隐蔽，关键变量只有一个：名叫 __obi 的 cookie。\n\n## 三步把账号和浏览足迹绑在一起\n\n复现过程在 Chrome for Android 上完成，作者用两套独立的抓包方法交叉验证，比对连续数月观察到的流量，覆盖 936 个广告像素、1029 个域名。\n\n- Step 1（签发 JWT）：用户在 chatgpt.com 上时，客户端先生成 16 字节随机数，向 \u002Fbackend-api\u002Fbazaar\u002Fobi\u002Fsync-token 发请求，后端返回 RS256 token，里面同时含 sub（账户 64 位 hex）和 obi（22 位标识符），绑定关系写死，60 秒过期。bzr 是 OpenAI 内部对广告平台「bazaar」的缩写。\n- Step 2（写跨站 cookie）：客户端把 token POST 给 bzr.openai.com\u002Fv1\u002Fobi\u002Fsync，下行 Set-Cookie 是 `Domain=.openai.com; HttpOnly; Max-Age=31536000; SameSite=None; Secure`——`SameSite=None` 加 Secure 是跨站请求能带上 cookie 的标准配置，存活期一年。\n- Step 3（广告主送回）：任何在 ChatGPT 上买广告的公司按 Meta \u002F Google 的套路在自家站点加载 bzrcdn.openai.com\u002Fsdk\u002Foaiq.min.js，脚本加载请求本身就附上 __obi，事件上报接口 \u002Fv1\u002Fsdk\u002Fevents 也带。用户在 Chewy、Wayfair、HelloFresh、Coursera 等 13 个广告主域名上的浏览数据都会回流 OpenAI，挂回 ChatGPT 账户。\n\n## SDK 还抓回了什么\n\n观察到的流量中，SDK 自动抓取的身份字段是广告主主动传入的 2.7 倍（685 vs 255）。tag-manager 总线是邮箱字段的最大来源——SDK 会替换 window.dataLayer.push、读 adobeDataLayer，并从 gtm.js 的 l= 参数里反推被改名的 GTM 层。0.1.31 版本曾抓过姓名和地理信息，OpenAI 在 8 月 27 日把范围收窄。邮箱、手机号、姓名经 SHA-256 哈希后再传输；国家、地区、城市、邮编明文发送。\n\nURL 只保留 origin + path，23929 次请求里没有一次带 query string，但 path 部分会跟随债务解决方案、医疗问诊、诉讼表单等敏感漏斗。\n\n## cookie 策略与边界\n\nOpenAI 把 __obi 列在「Analytics cookies」下，一年有效期，作用域 chatgpt.com 与 openai.com，这一节只有 __obi 一条。OpenAI 把分析和营销分成两个独立开关：oai_consent_analytics 和 oai_consent_marketing，作者解码的每一个 token 都带着 `consent_decision: analytics_allowed`——只开分析、不开营销的用户也会被装上 __obi。同一次抓包里：oai-did、oaicom-stable-id 被 `SameSite=Lax` 拦截，oai-client-auth-info 和会话 cookie 因域不匹配被拒，只有 __obi 被送出。\n\n边界要写明：仅在 Chrome for Android 上验证；Safari ITP 全局屏蔽第三方 cookie，iOS 任何浏览器都跑 WebKit，机制失效；约五次 ChatGPT 会话里只有一次触发 sync token；OpenAI 是否在服务端把 cookie 解析回账户，作者只观察到 collector 用 202 接收了事件；退出登录后 anonymous 主体最少持续 27 天；广告主看不到这个值，他们只是装了一个 conversion pixel，根本不知道访客被挂回了 ChatGPT 身份。\n\n## 为什么这件事和 Meta 那套不一样\n\n把登录账号、第三方 cookie、跨站转化归并到一个 profile，是 Meta 多年以前就建好的结构性等价物，机制本身是标准 adtech。问题在于它被装在一个 AI 聊天产品上：人会把不会发到社交网络的话讲给 ChatGPT，而 ChatGPT 正越来越多地代用户执行操作。把登录态绑到一个第三方 cookie，等于把对话上下文暴露给任何愿意买广告的网站。\n\n作者 9 月 14 日把机制和两个问题（为什么把 __obi 划为 analytics cookie；如果用户只同意 analytics、不同意 marketing，是否仍会收到 __obi）发给 press@openai.com 和 privacy@openai.com。OpenAI Support 回复确认了咨询并表示会内部 review，但没有回答这两个问题。","https:\u002F\u002Fwww.buchodi.com\u002Fchatgpt-now-knows-what-you-do-on-other-websites-via-ad-collector\u002F","6d888cdc-fc64-4ddb-bae5-dc53f5329740",[11,15,18],{"id":12,"name":13,"slug":13,"description":14,"color":14},"c33b1bbc-d6ce-4f61-9d5d-1a0704a6a09b","ai-policy",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",{"id":19,"name":20,"slug":20,"description":14,"color":14},"42e59a88-7795-47dc-a334-ef1e72c24347","openai",[22],{"id":23,"lang":24,"title":25,"summary":26,"content":27},"f0564494-6060-40f2-9237-6680d84324fe","en","OpenAI's __obi cookie ties ChatGPT to your web browsing","Buchodi reproduces OpenAI's tracker: __obi cookie binds to ChatGPT accounts and travels back from any advertiser site loading the OpenAI pixel.","\"Security researcher Jamie Larson (Buchodi) published a full teardown on the self-hosted Threat Intel newsletter describing how OpenAI uses an ad collector at bzr.openai.com to attach a cross-site behavioral profile to ChatGPT users. The mechanism is not subtle; the key variable is a single cookie named __obi.\\n\\n## Three steps to bind an account to browsing history\\n\\nThe reproduction runs on Chrome for Android. The author verified it with two independent capture methods and cross-checked against several months of traffic covering 936 distinct advertiser pixels across 1,029 hostnames.\\n\\n- Step 1 (issue a JWT): while on chatgpt.com, the client generates 16 random bytes and POSTs to \u002Fbackend-api\u002Fbazaar\u002Fobi\u002Fsync-token. The backend returns an RS256 token containing both `sub` (the account's 64-hex subject) and `obi` (a 22-character identifier). The binding is written into the payload and expires after 60 seconds. `bzr` is OpenAI's internal name for the ads platform \\\"bazaar\\\".\\n- Step 2 (set a cross-site cookie): the client POSTs the token to bzr.openai.com\u002Fv1\u002Fobi\u002Fsync. The response Set-Cookie is `Domain=.openai.com; HttpOnly; Max-Age=31536000; SameSite=None; Secure`. SameSite=None with Secure is the standard configuration for a cookie to travel on cross-site requests. Lifespan is one year.\\n- Step 3 (advertisers send it back): any company that buys ads on ChatGPT installs the SDK at bzrcdn.openai.com\u002Fsdk\u002Foaiq.min.js on its own site, the same way retailers install Meta and Google tracking code. The script-load request itself carries __obi, and the events endpoint \u002Fv1\u002Fsdk\u002Fevents does too. Browsing data from 13 advertiser domains (Chewy, Wayfair, HelloFresh, Coursera, and others) flows back to OpenAI and gets tied to the ChatGPT account.\\n\\n## What else the SDK collects\\n\\nIn observed traffic, the SDK scraped 2.7× more identity fields than advertisers passed in deliberately (685 vs 255). The tag-manager bus is the largest source of email: the SDK overwrites window.dataLayer.push, reads adobeDataLayer, and reconstructs renamed GTM layers from the l= parameter on the gtm.js script tag. Version 0.1.31 once scraped first\u002Flast name and geography; OpenAI narrowed the scope on 27 August.\\n\\nEmail, phone, first and last name are SHA-256 hashed before transmission. Country, region, city and postal code are sent in the clear. URLs are reduced to origin + path: none of 23,929 observed requests carried a query string, but paths reaching the collector included a medical-condition funnel, a debt-solutions funnel and a litigation intake form.\\n\\n## Cookie policy and SameSite behaviour\\n\\nOpenAI's policy lists __obi under Analytics cookies, one year, scoped to chatgpt.com and openai.com; it is the only entry in that section. OpenAI splits analytics and marketing into two separate consent switches: oai_consent_analytics and oai_consent_marketing. Every token the author decoded carried `consent_decision: analytics_allowed` — users who allow analytics and refuse marketing still get the cookie.\\n\\nIn the same capture, oai-did and oaicom-stable-id were blocked by `SameSite=Lax`; oai-client-auth-info and session cookies were blocked by domain mismatch. Only __obi was sent.\\n\\n## Limits worth stating\\n\\n- Verified only on Chrome for Android. Safari's ITP blocks all third-party cookies; every browser on iOS (including Chrome on iOS) runs on WebKit, so the mechanism does not work. Desktop Chrome is untested.\\n- About one ChatGPT session in five produces a sync token; the ChatGPT mobile web client serves ads without syncing.\\n- Whether OpenAI resolves the cookie back to the account server-side was not directly observed. The author only saw the collector accept events with HTTP 202.\\n- The mechanism still works when signed out. Of 932 decoded tokens, 736 were account_user and 196 anonymous; anonymous subjects are stable per device for at least 27 days.\\n- Advertisers cannot see the value. __obi lives on openai.com, a domain their scripts cannot read. They installed a conversion pixel and have no way to know their visitors are being resolved to a ChatGPT identity.\\n\\n## Why this is not the same as Meta's old playbook\\n\\nBundling a logged-in account, third-party cookies, and off-site conversion events into a single profile is a structural equivalent Meta built years ago. The mechanism itself is standard adtech. What has no precedent is running it on an AI chat product: people say things to ChatGPT that they would never post on a social network, and ChatGPT is increasingly acting on their behalf. Tying a logged-in session to a third-party cookie exposes conversational context to any advertiser willing to buy ChatGPT placements.\\n\\nThe author sent the mechanism and two questions to press@openai.com and privacy@openai.com on 14 September: why __obi is classified as an analytics cookie, and whether a user who grants analytics consent but refuses marketing consent still receives it. OpenAI Support acknowledged the inquiry and said it would be reviewed internally, but did not answer either question.\"","openai-obi-cookie-cross-site-tracking-chatgpt","2026-09-23T07:00:00Z","2026-09-23T01:05:25.949685Z","2026-09-23T01:05:25.949696Z",true,"agent",26,[36,45],{"slug":37,"tag_slug":37,"title_zh":38,"title_en":39,"intro_zh":40,"intro_en":41,"id":42,"is_active":32,"created_at":43,"modified_at":44},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":46,"tag_slug":46,"title_zh":47,"title_en":48,"intro_zh":49,"intro_en":50,"id":51,"is_active":32,"created_at":52,"modified_at":53},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":55},[56,61,66,71,76,81],{"id":57,"title":58,"news_slug":59,"published_at":60},"7fce8217-577f-4fd5-8f88-a1566cbf1290","微软与 OpenAI 法庭文件解封:LLM 训练数据被自家高管称为史上最大劳动窃取","microsoft-openai-doom-loop-nyt-copyright-2026","2026-09-23T05:03:20+00:00",{"id":62,"title":63,"news_slug":64,"published_at":65},"d54e1ab3-820a-45fd-a4e9-ccbf6802bd72","NYT vs OpenAI 案解封:微软高管承认 AI 抓取是「最大劳动盗窃」","nyt-openai-microsoft-hecht-largest-theft-of-labor","2026-09-23T03:00:00+00:00",{"id":67,"title":68,"news_slug":69,"published_at":70},"d9a24a72-c5b8-4117-b8c2-a9981180c8bd","AI 三巨头罕见同框：马斯克、Altman 站队 Amodei 喊停前沿研发","amodei-musk-altman-pace-ai-frontier","2026-09-14T02:00:00+00:00",{"id":72,"title":73,"news_slug":74,"published_at":75},"1fa6a7fd-75e3-4dbf-bc45-bdffacf3623a","白宫 AI 安全框架豁免中国开放权重模型:Anthropic 的「强制审查」主张落空","white-house-ai-framework-exempts-chinese-open-weight-models","2026-08-13T02:00:00+00:00",{"id":77,"title":78,"news_slug":79,"published_at":80},"f8d091db-ca3a-44f6-b004-0b5f8aba0bef","OpenAI 请来9位数学家,却管不住模型节奏","openai-math-advisory-group","2026-09-21T21:15:00+00:00",{"id":82,"title":83,"news_slug":84,"published_at":85},"9dd4a859-1153-4ecc-b69d-4ba4c5431129","智谱被开发者抓包后紧急上线数据零留存","zhipu-maas-zero-data-retention-zcode","2026-09-21T07:00:00+00:00"]