404 Media said in a newsletter on 15 October that ads in ChatGPT can be aimed at people by phone number or email address. Its writer said advertisers, or anyone with about five minutes, can place such ads. The writer made a test ad on ChatGPT, using no one's personal data. The same newsletter pointed to new research on spyware. 404 Media said it confirms that online ads have delivered zero-click mercenary malware to targets. That means spyware sold by firms, which infects a device without the victim tapping anything.
Much is still open. The newsletter does not say how many ChatGPT users are affected, or what OpenAI has said about it. It does not name the researchers behind the malware findings or the ad networks involved. The writer said this kind of targeting is normal in advertising. The writer also doubts that most ChatGPT users know an ad may appear because someone gave OpenAI their number.
For teams that run or buy software, this shows that contact details held by advertisers can shape what staff see inside an AI tool. 404 Media also links ad networks to spyware delivery, so ads are one route by which attackers can reach a chosen target.