Top stories

StateGlobe, a website launched in March 2026, published 50,000 AI-generated and unverified statistics covering SEO, marketing, e-commerce and web technology across 200 countries. The site, created with GPT-4.1 for roughly $50 and later expanded with 15,000 listicles, was largely deindexed by Google after launch but continued to receive retrieval traffic from ChatGPT. Over seven months, GA4 recorded more than 10,000 sessions from ChatGPT, while Cloudflare logged about 72,000 ChatGPT-User requests in the most recent 30 days and more than 600,000 bot requests overall. According to Ahrefs and Semrush, more than 330 referring domains linked to StateGlobe, including Shopify, DHL and Bluehost. The site’s invented figures were cited in an academic paper, investment research from Qatar’s largest financial group, an Indian economics publication and a Canadian influencer-community report. The experiment’s operator says these citations can make false claims appear more credible as other writers and models encounter sources that cite them. Peec AI subsequently launched a statistics page using checked data and source citations, reporting that it also began earning links quickly. The company recommends publishing verifiable, passage-level statistics with adjacent sources and dates, query-aligned headings, visible update dates, and accessible server-rendered HTML. It warns against publishing fabricated material and says LLM retrieval systems may change.

Regeringskansliet blockerar från och med måndag AI-tjänsterna ChatGPT och Claude på anställdas tjänstedatorer. Syftet är att styra medarbetare till AI-tjänster som organisationen har godkänt, däribland Microsoft Copilot. Digitaliseringsdirektör Mikael Wettercrantz säger på Regeringskansliets intranät att användning av AI-tjänster utan avtal kan få konsekvenser för informationssäkerheten. Regeringskansliet har samtidigt, efter en översyn, skärpt säkerheten i Copilot. Presstjänsten har inte lämnat detaljer om ändringarna med hänvisning till säkerhetsskäl. Vissa anställda kommer fortsatt att kunna använda en särskild plattform för AI-assistenter som Regeringskansliet har utvecklat, där ChatGPT och Claude finns tillgängliga. Användningen av DeepSeek hade redan begränsats. Flera svenska myndigheter har vidtagit eller överväger liknande åtgärder. Skatteverket och Statens institutionsstyrelse har infört spärrar, medan Kronofogden bereder frågan inför ett beslut. Trafikverkets internrevision rapporterade tidigare under året om utbredd och riskfylld användning av omkring tio AI-tjänster, inklusive hantering av känslig information och AI-genererade svar.

Parameter AI researchers reported a critical ChatGPT web vulnerability that let a malicious public conversation execute attacker-controlled JavaScript in a visitor’s authenticated chatgpt.com session. An attacker could send a normal ChatGPT share link; in the final demonstrated version, simply opening it triggered the exploit after about 4.5 seconds. OpenAI classified the report as P1 and confirmed a fix on October 26, 2026. The exploit combined ChatGPT’s HTML Preview feature with an interactive graph that loaded MathLive, a math-input library. Although Preview ran in a sandboxed frame on a separate origin, MathLive accepted cross-frame postMessage instructions from any origin to alter a virtual-keyboard layout containing raw HTML. That HTML created an unsandboxed srcdoc iframe inheriting the chatgpt.com origin. ChatGPT’s content-security policy blocked inline scripts but permitted YouTube scripts; researchers used YouTube’s JSONP-style oEmbed callback behavior to execute code. The injected code could call ChatGPT’s authenticated backend APIs, list recent conversations, retrieve a private conversation never shared with the attacker, and transmit selected data to an external server. OpenAI reproduced the JavaScript execution and private-conversation proof, updated two web frontend versions to reject the MathLive messages, and awarded a $5,000 bounty. The report was submitted October 18 after testing began October 13.

Starting in December, OpenAI will combine usage allowances for ChatGPT and Codex on Plus, Pro, and Business plans as it brings Work’s agentic capabilities into the main ChatGPT experience. Usage across both products will be measured in tokens, the units of information processed and generated by a model. Allowance consumption will vary by the selected model and requested task, with more advanced models and more complex tasks generally using more tokens. Instant chat will not count against the shared allowance. OpenAI expects most users will not need to wait for usage resets more often than they do currently. Users will be able to view combined remaining usage and reset times through Settings → Usage. People who reach their limit can wait for a reset, upgrade their plan, or purchase credits to continue using eligible features.

OpenAI has begun gradually rolling out Locked Chats for ChatGPT, allowing users to hide selected conversations from regular history, pinned chats, and search results. Locked conversations are stored under Projects > Locked chats and require a four-digit account PIN to open; supported mobile devices can also use Face ID, Touch ID, or device authentication. The feature is available across ChatGPT’s Free, Go, Plus, Pro, Business, Enterprise, and Edu plans, with some conversations—including temporary, archived, group, shared-link, Codex, and scheduled-task chats—ineligible. Resetting a forgotten PIN permanently deletes every locked chat, memories stored only in those chats, and content protected only by the old PIN. OpenAI says neither its support staff nor workspace administrators can restore or unlock that content, while changing a PIN that users still know preserves it. Locked Chats do not add end-to-end encryption, alter retention periods, or change whether chats are used to improve OpenAI’s models under a user’s existing settings. Enterprise and Edu locked chats remain available in compliance logs. New information from locked chats can be used across other locked chats when Memory is enabled, but not in regular conversations. Existing shared links remain accessible until separately deleted. Temporary Chat offers different protections: it does not appear in history, does not update memory, and is not used for model improvement, though OpenAI may retain copies for up to 30 days for safety.