Less than two years ago, Sam Altman called advertising "a last resort." On April 28, a security researcher published the full technical anatomy of ChatGPT's advertising infrastructure: a four-token attribution system, a merchant-side tracking SDK, and 720 hours of cookie persistence. The last resort arrived quietly.
How it works
When a user sends a message to ChatGPT, the response arrives via a Server-Sent Events stream at chatgpt.com/backend-api/f/conversation. Within that stream, ad units appear as single_advertiser_ad_unit objects containing advertiser brand data, carousel cards with imagery, and tracking tokens.1
The ads are contextual. Ask about a trip to Beijing and get a Grubhub food delivery ad. Ask about NBA playoffs and get Gametime ticketing. Spring fashion yields Aritzia retail. The targeting matches conversation topic, delivered in the same payload as the AI response.1
Ad creatives load from bzrcdn.openai.com, not from merchant servers. Links open in ChatGPT's in-app webview. OpenAI controls asset delivery and observes post-click navigation on top of any pixel signal the merchant runs independently.1
The four tokens
Each ad carries four encrypted Fernet tokens, each serving a distinct purpose in the attribution chain:1
ads_spam_integrity_payload validates ad clicks server-side against fraud. oppref is a forward attribution token that gets stored as a cookie on the merchant's site for 720 hours (30 days). olref logs the outbound link on OpenAI's servers. ad_data_token wraps additional tracking data in base64-encoded JSON with another layer of Fernet encryption.
Four layers of attribution, anti-fraud validation, and 30-day cookie persistence. This is a production advertising platform.
The SDK
Merchants implement tracking via the OAIQ SDK (version 0.1.3), loaded from bzrcdn.openai.com/sdk/oaiq.min.js. The SDK extracts the oppref token from URL parameters, stores it in a cookie called __oppref with a 720-hour TTL, creates a probe cookie called __oaiq_domain_probe, and sends measurement events back to bzr.openai.com/v1/sdk/events.1
The researcher notes that the entire system can be blocked by adding two domains to ad-blocking filters: bzrcdn.openai.com and bzr.openai.com.1
The context
The ads currently appear on the free tier and the $8/month ad-supported Go plan. Paid Pro and Plus subscribers do not see them.2 OpenAI has stated that ads do not influence model responses.
As one HN commenter put it: "'Ads don't influence responses' — they just arrive in the same payload, measured with four layers of attribution and politely pretend to be coincidences."2
The HN discussion (352 points, 237 comments) focused on what comes after. Google spent decades fighting SEO manipulation of search results. ChatGPT's responses draw from training data that companies can influence. Contextual ads in an AI conversation create an incentive to shape both the training data and the conversation simultaneously.2
Sam Altman, less than two years ago: "I kind of think of ads as a last resort for us for a business model. I would do it if it meant that was the only way to get everybody in the world access to great services."2
The attribution loop is four tokens deep and the last resort looks a lot like the plan.
Citations
- Buchodi Threat Intel, "ChatGPT serves ads. Here's the full attribution loop," April 28, 2026. Technical analysis of SSE stream, Fernet tokens, OAIQ SDK, and merchant tracking. buchodi.com
- Hacker News discussion thread, "How ChatGPT serves ads," 352+ points, 237+ comments. Includes Sam Altman "last resort" quote and community analysis. news.ycombinator.com/item?id=47942437