ChatGPT advertising attribution chain fully exposed: 4-layer Fernet encryption + contextual precise delivery, in-depth analysis of AI advertising technology architecture

Core conclusion

On April 28, 2026, security researcher Buchodi disclosed the complete technical implementation details of the ChatGPT advertising system on HN. This is not only a key step in the commercialization of OpenAI, but also the first public technical reference on how the AI ​​platform builds a native advertising attribution system.

Key findings:

• Event time: 2026-04-28 Public disclosure (the actual system has been running for a period of time)
• Affected objects: All AI tool builders, content creators, and affiliate practitioners who use ChatGPT
• Core changes: ChatGPT injects advertisements into the conversation SSE flow and implements a complete click attribution closed loop through 4-layer Fernet encrypted tokens

Key Points

• Ads are injected into the conversation stream in real time via the single_advertiser_ad_unit event of the SSE protocol
• Each advertisement carries 4 Fernet encryption tokens, forming a complete attribution chain
• Ad selection is based on contextual targeting, and the same account will receive different ads for different topics.
• The tracking SDK is called OAIQ (v0.1.3) and enables cross-page 30-day attribution via the first-party cookie __oppref

Background: Technical anatomy of ChatGPT advertising system

Buchodi scraped both ends of the ChatGPT advertising system - the user side (ChatGPT) and the merchant side (SDK) - through a "consented mobile traffic research cluster". This is the first time the industry has gained such a complete end-to-end view.

This system has two halves: the ChatGPT side injects structured advertising objects into the SSE stream, and the merchant side reports product browsing behavior in the browser through the OAIQ SDK. The two are connected via Fernet encrypted click tokens.

Advertising injection mechanism on ChatGPT side

When a user sends a message to ChatGPT, the backend injects advertising events in addition to the model output in the SSE response stream of chatgpt.com/backend-api/f/conversation:

event: delta
data: {
  "type": "single_advertiser_ad_unit",
  "ads_request_id": "069e89b3-c038-7764-8000-6e5a193e5f69",
  "ads_spam_integrity_payload": "gAAAAABp6Js_<...redacted...>",
  "advertiser_brand": {
    "name": "Grubhub",
    "url": "www.grubhub.com",
    "favicon_url": "https://bzrcdn.openai.com/cabfae7ead26b03d.png",
    "id": "adacct_6984ed0ba55481a29894bb192f7773b4"
  },
  "carousel_cards": [{
    "title": "Get Chinese Food Delivered",
    "body": "Satisfy Your Cravings with Grubhub Delivery.",
    "image_url": "https://bzrcdn.openai.com/...",
    "target": { "type": "url", "value": "https://...", "open_externally": false }
  }]
}

• single_advertiser_ad_unit Schema，（multi-advertiser ）
• advertiser_brand.id adacct_<32-hex>，
• OpenAI CDN（bzrcdn.openai.com），
• target.open_externally: false ChatGPT WebView ，OpenAI

4 Fernet

。 4 Fernet ，

Fernet 9 （ 0x80 + 8 Unix ）， OpenAI Token

import base64, struct, datetime
b = base64.urlsafe_b64decode("gAAAAABp7fdA" + "==")
print(datetime.datetime.utcfromtimestamp(struct.unpack(">Q", b[1:9])[0]))

# → 2026-04-26 11:30:08 UTC

Buchodi Home Depot URL Token 11:30:08 ， 11:31:43 。 95 。

， ChatGPT ****

AI

AI

1. ****ChatGPT 30 Cookie ， ChatGPT
2. **SEO+GEO ** ChatGPT ""，—— GEO AI ， AI
3. ** bzrcdn.openai.com bzr.openai.com** CDN ，

AI Agent

• **SSE ** Agent SSE LLM ，（ad units, tool calls ）。 SSE delta
• **OAIQ SDK ** Cookie + + Ferent —— AI Agent

• AI SSE
• ChatGPT Affiliate
• OpenAI SDK

• Buchodi: How ChatGPT serves ads
• HN : 407 points

OpenAI、ChatGPT、Canva. The platform side will automatically match tool_mentions of maintained tools.

Related reading

• Want to systematically learn AI automation workflow? Watch the tutorial: How to build an AI content automated distribution system with n8n + ChatGPT: a complete 30-minute tutorial
• Real case: How independent developers monetize AI capabilities: A real case of a data analyst using Claude Code + n8n to build an automated report SaaS with a monthly income of $3,800
• Advanced reference: 18-Year-Old Built a $5,000/mo SaaS With AI Agents — Zero Hand-Written Code