AI in 15 — September 21, 2026

There is a cookie sitting on your computer right now, set by OpenAI. It can tie what you browsed on Wayfair last night to the conversation you had with ChatGPT this morning. It's called double-underscore o-b-i. It lasts a year. And switching off ad tracking doesn't remove it.

Welcome to AI in 15 for Monday, September 21st, 2026. I'm Kate, your host.

And I'm Marcus, your co-host.

Today: a researcher takes apart OpenAI's ad infrastructure, and finds a tracking pixel on a dozen shopping sites.

A zero-click flaw in the four biggest coding agents. Two of them are still unpatched, and one never will be.

Alibaba ships a seven-billion-parameter image model that runs on a gaming card — with a licence that says you can't sell anything you make with it.

Plus a model that refuses to write sentences, and doubles its speed by doing so.

Marcus, start with provenance, because I know you're going to insist on it.

I am. This is one independent researcher's blog post, published at buchodi dot com, amplified to seven hundred points on Hacker News. OpenAI has not confirmed any of it. Commenters in that thread also flagged that the prose itself reads as machine-written. So: not a peer-reviewed disclosure.

And yet you think it's solid.

The technical claims are reproducible by anyone with a browser. Open developer tools on one of the named sites and look for the cookie. Three hundred and seventy-two comments, nobody has refuted it. That's about as good as unconfirmed gets.

So what did they find?

OpenAI's ad system is internally codenamed "bazaar." ChatGPT generates a sixteen-byte identifier, fetches a signed token, and stores it as a cookie called double-underscore o-b-i. The settings are the interesting part. Domain set to dot openai dot com. Max age, thirty-one million seconds — one year. And SameSite equals None, which is the flag that lets a cookie travel to other websites.

And the other websites are advertisers.

Companies buying placement inside ChatGPT install an OpenAI measurement pixel on their own sites. The researcher observed it firing on twelve of them — Chewy, Wayfair, ThriftBooks, Eventbrite, HelloFresh, Coursera, SeatGeek. When you load one of those pages, your browser hands OpenAI the cookie plus what you're looking at.

What does it actually collect?

Identity data four ways — fields the advertiser supplies, scraped form inputs, parsed page text, and tag manager data layers. Emails and phone numbers get hashed. Location — country, city, postal code — goes over in plain text. And the researcher logged URL paths that revealed medical conditions and financial circumstances.

Now here's the bit I keep coming back to. Doesn't rejecting marketing cookies stop this?

No, and that's the sharpest finding. The tracker is classified as an analytics cookie. So on a consent banner where you deny marketing, it keeps running. It also works if you're logged out — you get an anonymous per-device identifier that persists at least twenty-seven days. OpenAI Support acknowledged the researcher's September fourteenth inquiry and then declined to answer anything specific about the classification.

Marcus, is this unusual technically, or unusual in context?

Entirely in context. The mechanism is boring nineteen-nineties adtech. What's new is running it on a product people treat like a confidant. ChatGPT started selling ad space in February and enabled marketing tracking by default for free users by the end of April, so this is just that business model arriving on schedule. It arrived faster than users noticed.

Is there anything a listener can actually do?

There is, and it's unusually concrete. Firefox, Brave and Safari block this class of cross-site cookie by default. Chrome and Edge do not. So which browser you happen to have open changes what OpenAI learns about you, and you didn't choose that trade-off — you chose a browser.

Security. Researchers at AIR have disclosed something called Plugin4Shell, and it hits all four of the big coding agents.

Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. Zero-click remote code execution. And it doesn't attack the model at all — it attacks the plugin supply chain underneath it.

Unpack the trick.

It defeats SHA pinning. Pinning is how you lock a plugin to one exact reviewed version of the code — like checking a book's ISBN rather than trusting the title on the cover. The attack: create a git branch whose name is the forty-character commit hash you're pinned to, and make it the repository default. When the agent runs checkout on that hash, Git prefers the matching branch name over the actual commit object.

Wait — the name of a branch can impersonate a hash?

Git will resolve it that way, yes. So the agent installs attacker code and reports a successful, correctly-pinned install. Gemini CLI has a variant where it fetches the right commit and then checkout silently lands on a branch called FETCH_HEAD instead, discarding what it just downloaded. AIR's line is the one to remember: the agent checks out the exact commit the marketplace pinned, but never verifies it landed there.

Who's fixed it?

Anthropic in Claude Code 2.1.179, back in June. OpenAI in Codex 0.146.0 in August. Google has deprecated Gemini CLI and told AIR it will not patch — so every remaining install stays vulnerable permanently. Microsoft has not fixed Copilot.

AIR found this when?

Working proof-of-concept in May, coordinated disclosure in June. No CVE identifiers in the writeup, which I'd want. Exposure is anyone running a major coding agent that installs marketplace plugins — plausibly millions of installs.

Why does zero-click matter so much here?

Because agents auto-update their plugins. There is no moment where a careful developer gets to look at a diff and decline. The two defences everyone was told to rely on — review the code, pin the hash — both pass while the attack succeeds. And for two of these four products, the remediation is "stop using them." That isn't a patch.

Something lighter. Alibaba shipped an image model yesterday.

Qwen-Image-2.1. Open weights, and the generation component is seven billion parameters — down from twenty billion in the previous version. It unifies text-to-image and image editing in one system, and it runs on consumer hardware. An RTX 3090 is enough.

They're claiming it beats closed models.

On Qwen's own benchmark. Independent validation is still pending, so I'd treat that as a marketing claim until someone else measures it. What's genuinely new are three capabilities. Native RGBA transparency — a real alpha channel, meaning it can output an object on a transparent background, so you're not running a separate cut-out step. Up to ten reference images in a single pass, which matters for group portraits or virtual try-on. And guided editing, where you circle or paint over the part you want changed.

And it's fast?

Architecture changes plus cache reuse, especially in the multi-reference case. Day-zero support in ComfyUI, Diffusers, vLLM and SGLang, which tells you the ecosystem was expecting it.

So where's the catch? There's always a catch.

The licence. Previous Qwen models shipped largely under Apache. This one is the Qwen Research License — research and evaluation only. Commercial use requires emailing Qwen for a separate agreement. Someone on Hacker News retitled the whole release: "Seven billion open weights you cannot ship."

Is that a trend or a one-off?

I'd call it a trend. Chinese open-weight releases have been getting more restrictive precisely as they get good enough to matter commercially. Open weights was never the same thing as open source, and this is where the distinction stops being pedantic.

Anything else worth pulling out?

The text rendering. Developers building real products are posting side-by-sides against gpt-image-2 and finding it close. And there's an observation from that thread I keep thinking about — local image generation is now meaningfully ahead of local code generation. You can get near-frontier images on a gaming card in seconds. You cannot get near-frontier code the same way.

A quick update on a story we covered Saturday — the hallucinated intelligence report that nearly triggered a military operation. TechCrunch has a follow-up.

The detail worth adding is the framing from Jake Steckler at GovAI, who's also a veteran Army officer. His argument is that the answer is stronger safeguards rather than pulling the tools out, and that service members need to understand the uncertainty inherent in these models, particularly where the decision involves use of force.

You said Saturday the hallucination wasn't the real failure.

And I'll say it more precisely today. The problem is laundering. The same tool that invented the claim then dressed it in the formatting conventions that make intelligence look vetted. The institutional signals a reviewer uses to judge credibility were exactly the signals the model was best at faking. That's a process problem, and every organisation plugging a model into a review chain is about to inherit it.

Governance, briefly. Sam Altman briefs the UN Security Council on Wednesday.

Fifteen members, in person, during the General Assembly. France holds the rotating presidency and convened the session. Remarks expected to centre on international coordination and shared safety standards. Diplomats expect senior Anthropic presence too, unconfirmed as of the Reuters report.

And this lands in the middle of a real argument.

September twelfth, Dario Amodei publishes what he calls "pacing the frontier" — note "pace," not "slowdown." Three planks: independent third-party evaluators embedded inside AI companies, safety-standard coordination among labs in democracies, and international coordination. Two days later Jensen Huang rejects the premise outright, echoing the line that the AI backlash is a hoax and no new regulation is needed.

Where do you land?

On a question rather than a side. The interesting tension isn't safety versus speed, it's who sets the pace. A scheme where the frontier labs coordinate standards and nominate their own evaluators is also a scheme that gives incumbents a say over who gets in. And there's a concrete test of that already — Anthropic's first embedded third-party evaluator turns out to be Accenture. That tells you what "independent evaluator" means in practice.

Last one, and it's my favourite. A model that won't talk to you.

It's called Jev, from TypeSafe AI, founded by Diogo Almeida — a former OpenAI researcher who worked on ChatGPT and on RLHF. It's a transformer, but it doesn't emit text. It emits decisions with calibrated confidence scores. A probability, not a paragraph.

Why is that better?

For a narrow class of work, enormously. No hallucinations, because there's no free text to hallucinate in. Five to eighteen times faster than OpenAI models on certain tasks. Ten to twenty times cheaper than Gemini for email classification. Output tokens are free, and input is metered in billions rather than millions. Almeida describes it as a "System One" model — intuition, not reasoning — trained purely on synthetic data.

What are developers actually saying?

Something specific rather than vibes. One put it that Jev is the only model that hands back a real probability, which makes it ideal for automating workflows. If you're routing tickets or triaging emails, a number you can threshold on is worth more than prose you have to parse.

And somebody made it talk anyway, didn't they.

Of course they did. There's a project called jevchat that coaxes Jev into acting as a deliberately terrible chatbot by repeatedly querying its decision outputs. Commenters compared it to consulting a death crystal.

Why does this matter beyond the novelty?

Because it's the counter-trend to a year of scaling everything. Most production AI work is classification, routing and triage — and the industry has been paying frontier-model prices to do it. A model that does less, faster, for a tenth the cost is the unglamorous shape a lot of this settles into.

One to watch: Altman at the Security Council on Wednesday. First time a frontier-lab CEO addresses it directly, France convened it, and if Anthropic shows up at a high level, the pace-the-frontier proposal gets argued in front of governments that could act on it rather than in blog posts.

Agreed, but temper it — the Council produces statements, not enforcement. And Jensen Huang's flat rejection eight days ago is a reminder that the people building the chips weren't in the room.

That's your AI in 15 for today. See you tomorrow.