OpenAI's ad pixel ties ChatGPT accounts to what users browse on advertiser sites

A measurement study published on 20 September documents __obi, a year-long OpenAI cookie that links a ChatGPT account to browsing on sites carrying OpenAI’s advertising pixel. Alibaba open-sourced Qwen-Image-2.1, a 7B-parameter unified generation-and-editing model with native transparent output, under a licence that bars commercial use. Four new papers converge on the same methodological complaint from different directions: the metrics teams use to evaluate agents and judges do not predict the thing they are being used to predict.

Security #

A ChatGPT cookie binds your account to an ad network, and it keeps working when you are logged out #

buchodi / Lobsters

The mechanism is three steps. ChatGPT generates a random 16-byte identifier and requests an RS256 JWT from /backend-api/bazaar/obi/sync-token that binds the identifier to the account and expires in 60 seconds; the client posts that token to bzr.openai.com/v1/obi/sync, which replies with Set-Cookie: __obi=«value»; Domain=.openai.com; HttpOnly; Max-Age=31536000; Path=/; SameSite=none; Secure. Any advertiser running OpenAI’s pixel then causes the browser to send __obi back to OpenAI alongside the page being viewed. The author analysed 936 distinct advertiser pixels across 1,029 hostnames and decoded 932 sync tokens, of which 736 were for logged-in users and 196 were anonymous but stable. The pixel collects SHA-256-hashed email and phone, plus country, region, city and postal code transmitted in the clear, and page paths — including medical, debt and litigation intake forms. Identity is mostly scraped rather than supplied: 685 events came from SDK interception of window.dataLayer.push and similar tag-manager buses against 255 from values the advertiser deliberately passed, and 638 of 881 pixels had automatic matching enabled. In live testing __obi was observed going out from Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera and SeatGeek; across a wider sample, 12 of 30 distinct cookie values appeared under more than one advertiser and one reached ten. The findings were sent to OpenAI on 14 September; support acknowledged receipt and did not answer the two questions asked. OpenAI’s cookie policy classifies __obi as analytics.

The classification is the part with consequences, because it is what determines which consent banner the cookie falls under in every jurisdiction that distinguishes the categories. A stable cross-site identifier that is joined to an authenticated account and shipped to a first party by 936 third-party sites is a marketing identifier by any working definition, and calling it analytics is not a labelling quibble when the label selects the legal regime. For anyone building on OpenAI’s platform there is a narrower operational point: if you install the measurement pixel to attribute ChatGPT ad spend, the automatic-matching default means your tag-manager layer is being read, and whatever your marketing team pushes into dataLayer is what leaves. The 196 anonymous-but-stable tokens are the detail to sit with — the identifier survives logging out, which means the graph is not opt-in by way of signing in. Chrome only; Safari and iOS browsers block the third-party path.

Model Releases #

Qwen-Image-2.1 puts unified generation and editing in 7B parameters, with transparency native and commercial use barred #

Qwen / The Decoder / TechNode

Alibaba’s Qwen team open-sourced Qwen-Image-2.1 on 20 September. The visual generation component is 7 billion parameters, it handles text-to-image and image editing in one workflow rather than as separate models, and the new capabilities over the prior version are native RGBA generation and editing, mask-guided local edits, and composition from up to ten reference images at once. Output is native 2K across multiple aspect ratios, architecture changes plus KV-cache reuse are credited with the inference speedup — which matters most in the multi-reference case — and it runs on a consumer GPU in the RTX 3090 class. Weights are on Hugging Face, GitHub and ModelScope with a demo. The licence is the Qwen Research License Agreement, which prohibits commercial use; businesses must apply separately for a grant.

Native RGBA is the feature to notice and it is underrated relative to the parameter count. Every production image pipeline that composites — ad creative, game assets, UI mockups, product photography — currently runs a generation model and then a separate background-removal model, and the second stage is where the artifacts come from, because it is inferring an alpha channel that was never generated. A model that emits alpha directly removes a whole stage rather than making it faster. Against that, the benchmark claim is Qwen beating most closed models on Qwen’s own benchmark with no independent results yet, which is the weakest form this claim takes; treat it as unverified until someone outside runs it. The licence is the harder constraint and it is not a detail — “open-sourced” here means weights you can read and cannot ship, which for the compositing use case above is precisely the use that needs the grant.

Research & Papers #

Rewording a judge’s instruction without changing what it asks costs agreement on all four tasks tested #

arXiv (Bellibatlu, Raff, Zhang)

JudgeSense issues 880 human-labelled items to twenty-five judges from six providers under two instructions that differ in wording but not in what they ask, across four evaluation tasks, and releases the complete decision logs. Every score is reported against the judge’s agreement with itself on the identical prompt, so decoding noise is not charged to the rewording. Rewording costs agreement on all four tasks and clears the authors’ threshold for a practically meaningful effect on two. The ordinal task is both the least stable and the one fewest judges are accurate on, and within a single model family parameter count does not predict stability. The finding with the most direct operational bite: a judge measured inside an agent harness yields a smaller sensitivity estimate than the same judge reached by direct API call, because its self-agreement collapses faster than its cross-wording agreement.

The harness result inverts the obvious reading of a stability number, and any team benchmarking its own judge should read it before trusting an in-harness measurement. A low wording-sensitivity score measured through a harness can mean the judge is robust or it can mean the harness has made it noisy enough that wording no longer stands out against the baseline — the ratio looks the same either way. Separating the two requires reporting self-agreement as its own figure, which is what this paper does and what almost no internal eval does. That baselining discipline is also what makes the negative result on parameter count credible: scaling the judge within a family does not buy stability, so the standard remedy of reaching for a larger judge is not supported here.

Fine-tuning improved next-turn scores for every model tested and none of them completed more workflows #

arXiv (Laskar et al.)

The study fine-tunes Qwen3 at 4B and 14B and Gemma 3 at 4B and 12B on multi-turn customer-support workflows, then evaluates two ways: the standard protocol, where the model predicts the next action given the gold interaction history and is scored against a reference, and holistic execution of the whole workflow autonomously. SFT consistently improved text-turn success, and overall next-turn success rose for every one of the four models under gold-history evaluation. None of the four succeeded at holistic workflow evaluation; strict trajectory completion reached at most 10.4% workflow success. The authors’ recommendation is to report text quality, local action correctness, tool execution and end-to-end completion as four separate numbers rather than one.

The mechanism is the gold history, and it is worth being explicit about why it flatters: scoring each turn against a reference trajectory silently repairs every prior mistake before the next decision is made, so the protocol measures the model’s behaviour on states a competent agent would have reached rather than on the states its own errors produce. That is the entire difference between 4-for-4 improvement and 0-for-4, and it means the metric is not merely noisy but biased in a known direction. Anyone whose agent evaluation runs on recorded traces with reference continuations is measuring under this protocol whether or not they call it that. The 10.4% ceiling is a small-model result on one task family and should not be read as a frontier number, but the gap it illustrates is a property of the protocol and does not obviously shrink with scale.

Coding agents lose 27 points of assertion pass rate as structural constraints accumulate #

arXiv (Dente, Satriani, Papotti)

The authors fix a unified API contract across 80 greenfield generation tasks and 20 feature-implementation tasks spanning eight web frameworks, then evaluate with both end-to-end behavioural tests and static verifiers so functional correctness and structural conformance are scored separately. Evaluated configurations lose 27.28 points on average in assertion pass rate going from baseline tasks to fully specified ones — the effect the paper names constraint decay. Framework sensitivity is large and asymmetric: mid-tier models do well in minimal, explicit frameworks such as Flask and substantially worse in convention-heavy ones such as FastAPI and Django. Error analysis puts data-layer defects first among root causes, specifically incorrect query composition and ORM runtime violations.

The framework result is the actionable one, and it runs opposite to the usual assumption that conventions help a model by narrowing the space. A convention-heavy framework requires the agent to hold implicit structure that is nowhere in the prompt and only partly in the code it can see, whereas an explicit framework puts the same information in front of it; that is why Flask wins here and it suggests the lever teams actually control is making the convention explicit in the repository rather than trusting the model to have absorbed it in training. The ORM finding points the same way — the data layer is where the gap between what the code says and what the framework does at runtime is widest. One caveat on generalisation: greenfield generation against a fixed API contract is a cleaner task than modifying an existing service, and constraint decay measured on the clean version is a lower bound on the messy one.

An adaptive test cut a production agent benchmark to 38.5% of its questions for 1.03 points of error #

arXiv (She, Lin)

Using 574 historical runs of the benchmark for a production analytics agent serving tens of thousands of monthly active users, split chronologically into calibration and held-out periods, the authors compare random sampling, historical caching, fixed representative subsets and IRT-based adaptive testing. Multidimensional 2PL adaptive testing gives the best score fidelity: 200 questions, 38.5% of a full run, for 1.03 percentage points of mean absolute error. They nonetheless deployed difficulty-stratified fixed subsets instead, for operational simplicity, and report that those subsets transfer to five other agent families without recalibration and stay stable on calibration windows as short as one day.

The deployment choice is the more useful result than the winning method, and the authors are unusually candid that they did not ship the thing that scored best. A fixed subset can be diffed, cached, attached to a pull request and re-run by someone else; an adaptive test selects different questions per run, which means two scores are not directly comparable and a regression cannot be localised to a question. That is a real cost in a CI path and it outweighs a few points of fidelity. The transfer-without-recalibration claim is the one that would save other teams the most work and also the one resting on the least evidence here — five agent families from one organisation, with no account of how similar they are.

Open Source #

Kev reproduces a proprietary decision model on Qwen3.5 with LoRA, and lands 4.5 points behind it #

jaredpalmer / Hacker News

Kev is a family of small decision models at 0.8B, 4B and 9B parameters, built on Qwen3.5 bases with a rank-16 LoRA adapter and a small pointer head, released under Apache 2.0 and explicitly modelled on TypeSafe’s Jev. On held-out test data drawn from the training sources, Kev-4B reaches 0.870 accuracy at a Brier score of 0.266 and Kev-9B 0.837 at 0.243. On datasets it was not trained against, Kev-9B falls to 0.812 accuracy and 0.291 Brier, roughly 4.5 percentage points behind Jev. Earlier Qwen3-based variants remain available alongside the current generation.

That the 9B is less accurate than the 4B on in-distribution data while carrying the better Brier score is the interesting row, and it is the one to read carefully: the larger model is worse at picking the right answer and better at knowing how sure it is. For the routing and guardrail jobs this class of model is sold for, calibration is usually the property that matters, since a caller that can trust a 0.7 can set a threshold and a caller that cannot has to treat every output as a hard decision. The 4.5-point out-of-distribution gap is the honest headline number and it is small enough to matter — an Apache-2.0 LoRA on an open base getting within five points of a closed model on unfamiliar data is the first datapoint on how much of Jev’s advantage is architecture and how much is the training set. It is also self-reported by the replicator on benchmarks of their own selection, which is the same caveat that applies to the original.

Treating Jev as a next-symbol oracle produces a working chatbot and an accidental calibration test #

kyle-pena-nlp / Hacker News

JevChat drives text generation out of a model that does not generate text, by asking Jev at each step which symbol comes next and sampling from the returned distribution. Four query strategies are implemented: a single choice over the whole alphabet, bisect with yes/no questions narrowing symbol groups, buckets spreading the alphabet across several questions with an escape option, and refine, which rescores bucket results for finer resolution. The reported finding is that “hypothesis” presentation — having Jev score the complete resulting text rather than an isolated next symbol — triples top-1 accuracy and doubles the probability mass landing on the correct symbol. The author describes the cost as impractical and the output as hilarious rather than good.

The hypothesis-mode result is worth more than the joke it arrived in. A model that scores a candidate continuation three times better than it scores the symbol that would produce that continuation is telling you its probabilities are defined over finished artifacts, not over steps — which is exactly the shape the 2048 experiment reported here yesterday found from the other end, where the model played at baseline from the board alone and beat a rule-based strategy once the caller supplied the projected outcomes. Two unrelated hobbyists have now independently established the same interface constraint: construct the candidate, then ask. Anyone putting one of these models in a routing path should be scoring options, not asking for a next action.

Infrastructure #

Samsung is expected to at least double HBM4-family output next year as the mix shifts to HBM4E #

Seoul Economic Daily / DigiTimes / Hacker News

Total Samsung HBM output is expected to rise roughly 40% to about 250,000 wafers in 2027 from around 180,000 this year, while the HBM4 family’s share of that total goes from about 40% to about 80% — which is where the doubling comes from, a moderate capacity increase multiplied by a large mix shift as HBM4E reaches mass production. The supporting datapoint is outsourced cleaning volume for glass carriers, which Samsung plans to take from 20,000 sheets a month this year to 50,000 next; HBM4 and HBM4E are 12-layer-and-higher stacks, so a 2.5x increase in carrier volume is difficult to reconcile with anything less than a doubling of finished units. Samsung unveiled HBM4E last month, rated at up to 16Gbps per pin, more than 20% faster than HBM4. The report is sourced to industry figures rather than to Samsung.

The glass-carrier number is why this is worth reading as a supply signal rather than a plan. Stated capacity intentions from memory vendors move with the market and get revised quietly; an outsourcing contract for consumables at 2.5x volume is a commitment with a counterparty, made far enough upstream that it is hard to walk back, and it is the kind of detail that leaks before the announcement does. For anyone modelling accelerator availability in 2027, the mix shift matters more than the wafer count: HBM4-family share going from 40% to 80% of a growing total is a much larger change in the supply of the specific memory that next-generation parts require than the headline 40% growth suggests. The caveat is that none of this is from Samsung, and the wafer figures are industry expectation rather than disclosed guidance.

Other #

The world-model companies will not say what they are building, and neither will their data suppliers #

TechCrunch

TechCrunch went to the funded companies in the world-models space — Yann LeCun’s AMI Labs, less than a year old, and Fei-Fei Li’s World Labs, whose Marble is the most developed product anyone has shipped — and could not get product plans, timelines or commercialisation strategy from any of them. Michael Rabbat of AMI Labs: “We’ll talk about it when we’re ready to talk about it.” The silence extends down the supply chain; the CEO of Physicl, which sells these companies data, does not know what the data is being used for. Both companies are well capitalised and low on revenue. The explanation offered is competitive: naming a target market — robotics, video games, autonomous driving — tells rivals where to aim, and while funding is plentiful there is no pressure to name one.

The data-supplier detail is the one that carries information rather than atmosphere. A vendor who does not know the end use cannot tune collection to it, which means these companies are either buying general-purpose spatial data because they have not committed to an application, or deliberately paying the tax of under-specified data to avoid revealing the application through their purchase orders. Those are very different states of the field and the article cannot distinguish them — but the first is much more consistent with “well funded, low revenue, exploring multiple directions.” Read that way the secrecy is less a strategy than a description: there is not yet a product roadmap to disclose, and “we’ll talk when we’re ready” is accurate.

Threads to Watch #

Four papers today attack the same failure and it is not a model failure. JudgeSense finds that rewording a judge’s instruction moves its verdict, and that measuring the judge inside a harness hides how much. The customer-support study finds that fine-tuning improved next-turn scores for four models out of four and workflow completion for none. Constraint decay is measured only because the authors scored structure separately from behaviour instead of collapsing both into a pass rate. The production-benchmark paper exists because rerunning the full suite is too expensive to do honestly every time. In each case the model is doing roughly what it always did and the measurement was reporting something other than what the team believed it reported. That is a different remediation path from a capability gap: it is fixed by splitting metrics apart and publishing self-agreement baselines, not by a larger model.

The System One category is now being probed by outsiders faster than its vendor can define it. Six days after Jev shipped, there is an Apache-2.0 replication on Qwen3.5 landing 4.5 points behind it out of distribution, a chatbot built by treating it as a next-symbol oracle, and — from yesterday — a 2048 harness and a LangChain judge evaluation. The two experiments that probed the interface rather than the accuracy agree: the model scores candidates well and chooses poorly, so whatever constructs the candidates has to sit outside it. Kev is the more consequential of today’s two, because a LoRA on an open base within five points of the closed model puts a ceiling on what the proprietary version can charge for, and because it is the first version of this thing anyone can evaluate without a waitlist.

Two releases today were called open and neither is. Qwen-Image-2.1 ships weights under a research licence that bars commercial use, and __obi is an opt-out-by-nothing identifier that OpenAI’s own policy files under analytics. The word doing work in both cases is a category label rather than a technical claim, chosen by the party it benefits, and in both cases the label selects a downstream regime — what you may ship, which consent banner applies. Kev is the contrast that makes the point: Apache 2.0, weights and numbers published, nothing to apply for.