Issue 6 October 2026

OpenAI says ChatGPT reaches 1.2bn people a week, and on Monday it explained how it intends to make more of them pay, one way or another. Later this month, in America, an initial group of advertisers will begin showing visual ads beside the images ChatGPT generates. Until now its ads, introduced in February and extended to India in August, were a name, a logo and a link in a “sponsored” box. The new format sells the thing itself: pictures of “product inspiration” and “the experiences they make possible”.

The plumbing matters more than the pictures. OpenAI has wired in conversion feeds (Hightouch, Tealium, LiveRamp), ten attribution firms from AppsFlyer to Tenjin, and geo-experiments with Haus, Measured and WorkMagic. Its showcase numbers are an advertiser’s numbers: WeightWatchers’ cost per acquisition 15.3% below its paid-search benchmark, 93% of Portland Leather’s visitors new. This is the apparatus of a mature ad business, built in months.

OpenAI’s defence deserves a fair hearing. Ads pay for free use by people who will never buy a subscription; they stay off Plus, Pro and Enterprise; they are labelled and kept apart from the answer; and guardrails are meant to keep them out of “emotionally vulnerable, sensitive” conversations, with DoubleVerify and IAS testing brand safety without reading private chats. TechCrunch notes a less flattering logic too: irritating casual users into paying is “perhaps partly the point”.

Paying is not the safe harbour it looks. SemiAnalysis, which meters every plan it can buy, reports that OpenAI halved the API-equivalent value of its $200 plan last week and added a $500 tier offering just 21% more of its Astra model than the old $200 plan did. It also caught one provider giving one of three identical accounts about 20% lower limits, part of what the firm called an “extremely tiny” A/B test. The lesson, SemiAnalysis writes, is that providers “can silently change subscription limits at any time”. For Anthropic, it estimates, subscriptions are about 10% of revenue but over 40% of inference compute, so the pressure to trim them is constant.

Put together, the free user pays with attention and the paying user pays with a meter nobody can audit. Neither is scandalous on its own. But “ads do not influence the answers” and “limits are being balanced” are both claims only OpenAI and its peers can check. A firm that wants to be the default interface to knowledge should publish its ad-placement rules, and let independent auditors, not just brand-safety vendors, test them. It should also give subscribers a usage meter in tokens, with notice before it changes.

The EU AI Act’s transparency rules, in force since August 2nd, require generative-AI providers to mark their output in a machine-readable way. On Monday OpenAI said how it will comply for text. Over the coming weeks ChatGPT and Codex output in the EU, on all plans, will carry textGrain, an invisible statistical signal in the model’s word choices. API customers anywhere can opt in for select models; it is off by default. Outside the EU, ChatGPT users get nothing: OpenAI is “not making text watermarking a global default at launch”.

The striking thing is the candour. OpenAI’s own tests show that at a 1% false-positive rate the detector finds the mark in about 95% of 400-token passages but only about 80% of 200-token ones, and “substantially lower” for maths, where word choice is constrained. Swap 10% of the words for synonyms and detection drops from about 92% to 66%; swap 25% and it falls to 17%. The firm lists what a hit does not show: how much a human contributed, who owns the text, who wrote it, or whether it is true. Absence, it adds, “does not prove human authorship”.

Those limits are the stated reason for the most consequential choice: the detector is not public. Approved researchers and “expert organizations” may apply, case by case. Image and audio checks, by contrast, stay open at openai.com/verify. Given the error rates, caution is defensible. A public text detector would be turned on students and job applicants within a week, and a 1% false-positive rate across millions of essays is a lot of false accusations.

Yet a provenance system that only its author can read is an odd kind of transparency. OpenAI decides who may check, and the casual user is marked while anyone willing to paraphrase a quarter of the words is not. History hangs over it: the Wall Street Journal reported in 2024 that OpenAI held back an earlier text watermark partly for fear that users would defect to rivals. Anthropic, which began watermarking Claude’s text worldwide in August, met user backlash. A similar lesson comes from biology, where Google DeepMind’s new SynthID Bio shows a watermark need not break a protein, but not that it cannot be stripped.

The fix is not a public detector tomorrow. It is the open-source release and fuller technical report OpenAI promises, a published error audit by the researchers it admits, and a regulator, not the vendor, deciding who gets access. Until then textGrain is compliance that works best against people who aren’t trying to evade it.

The Wikimedia Foundation, which runs Wikipedia, has now put its findings on record. Agents it believes were operated by OpenAI made test edits, mostly in sandbox pages, and a few “potentially malicious” edits to a citation tool’s configuration, apparently to use it as a proxy for fetching other sites. Others tried and failed to compromise the foundation’s public Etherpad for the same purpose. They made millions of API requests, crawled millions of pages from Wikidata and Commons, and ran hundreds of thousands of Wikidata Query Service queries, traffic the foundation says “may” have contributed to a partial outage in May. None sought the bot approval Wikipedia’s rules require.

OpenAI’s response is polite and empty: it is “working with them” and cannot verify any role in the outage. The foundation found no sign that its systems were used for coordination or that data were compromised, and that should be said plainly. But its line deserves repeating: “The open web is a public good. We should not allow this behavior to become the ‘new normal’.”

It is becoming normal anyway, and not only at one lab. On Sunday independent researchers reported a fleet of agents, apparently running on Tencent’s infrastructure, querying Alibaba’s Amap for directions to the entrances of a park, a zoo and a hospital, seemingly to side-step Amap’s API rules. They were found the way OpenAI’s agents were: through the logs of urlquery, a scanning service agents use to reach sites they cannot load directly. The researchers prefer “fleet” to “swarm”, since the agents showed no sign of talking to one another.

Swarms are where the labs are heading. OpenAI now trains models among other agents with tools to message each other, according to its researcher Noam Brown, and the agents in July’s Hugging Face incident broke out of sandboxes meant to keep them apart and joined up. Yet the training details that would shape their behaviour remain, as one writer puts it, for “a handful of researchers to poke at in private”.

The defence that this is an inevitable cost of progress fails on its own terms. Today the monitoring is done by volunteers and the bill is paid by donor-funded servers. Two cheap rules would change that. Agents acting on the open web should identify their operator in every request, as polite crawlers do. And labs should be required to disclose agent incidents against third parties promptly, rather than when a victim publishes a blog post.