Free AI is getting a sponsor, and the ad business is starting to colonize the output itself. Elsewhere, Cloudflare is trying to turn the rise of bots into a billing model, and Debian’s kernel patch count is eye-watering.
1. OpenAI puts ads next to your generated images, and builds the scoreboard first
Later this month, ChatGPT users in the U.S. will start seeing visual display ads alongside the images they ask it to generate. TechCrunch reports an initial test group of advertisers. OpenAI says the ads will be labeled and won’t influence ChatGPT’s answers. Ads first arrived earlier this year to support free and low-cost tiers, and reached India in August.
The more telling detail is the plumbing. OpenAI is adding click-attribution and measurement partners, including AppsFlyer, Adjust, Kochava and Triple Whale. It is also running geo-based experiment partnerships and brand-suitability pilots with DoubleVerify and Integral Ad Science. That is the machinery advertisers demand before they spend real budget. A chatbot with 1.2 billion weekly users, a figure TechCrunch cites, is only an ad business once someone can prove what the ads did.
TechCrunch also floats a cynical reading: annoying ads may nudge casual users toward a paid plan. That is the outlet’s speculation, and OpenAI hasn’t said it. One caution for builders: the reporting covers ChatGPT, not the API, so nothing here says apps built on OpenAI’s models will carry ads. Whether that line holds as ad revenue grows is the question to watch.
2. Debian’s kernel update has 1,313 CVEs, but the cause is unproven
The Register’s headline says Debian’s latest kernel security update has 1,313 reasons to patch. That number is striking, and the right response for Debian users is the boring one: apply it.
The text we could retrieve is not the article body. It is a sidebar of unrelated Register headlines, one of them about Anthropic’s Mythos bug-hunting model. That is page furniture, not evidence tying the update to AI-assisted vulnerability hunting, so it can’t support a claim that AI tools are swamping maintainers.
The theory is plausible and worth testing: more automated discovery means more reports, and more reports mean more triage for volunteers. But the evidence here doesn’t establish it. The useful follow-up is how many of those CVEs are newly found, how many are backlog, and who found them.
3. Cloudflare wants to bill AI agents and issue the web’s post-quantum certificates
Cloudflare opens its Birthday Week wrap-up with a claim: automated traffic has now surpassed human activity on the Internet. Its answer is to monetize that traffic. Monetization Gateway, in beta, lets sellers charge AI agents using HTTP 402 and x402. Pay Per Use promises reports, billing and payouts to publishers when verified AI buyers use their content. That is a bet that agents will pay rather than scrape, and that Cloudflare will sit between them.
The security announcements are the other half of the pitch. Cloudflare says it intends to become a public certificate authority, issuing free Merkle Tree Certificates designed to make post-quantum authentication practical. It is aiming to finish its own post-quantum migration by 2029. It also helped develop an IETF extension against quantum downgrade attacks on IPsec, and now shows customers whether requests negotiated post-quantum key exchange. Note the verbs: intention, aiming, planned. This is a roadmap with some shipped pieces, not a finished transition.
Among 46 announcements, the practical one for cost-watchers is AI Gateway’s Auto Router. Cloudflare says it classifies each request at the edge and sends it to a suitable model, cutting cost while preserving quality. That is Cloudflare’s own claim, and it comes with no benchmark in the post. The broader pattern is a company selling the tolls, the locks and the cost controls for agent traffic at once.
