February 2026: OpenAI tests ads, GPT-4o retires, and a zero-day finds Claude

OpenAI tests ads: the business model pivot

OpenAI's decision to test advertising inside ChatGPT was not entirely surprising. The company had been spending more on compute than it was generating in subscription revenue for most of its public history. The path to profitability at the scale OpenAI needed required either dramatically increasing subscription prices, reducing costs, or finding new revenue streams.

The ads test was limited in scope: sponsored responses in certain query categories, labelled clearly, on the free tier. The targeting approach was content-based rather than user-profile-based, which OpenAI emphasised as a privacy-protective design choice. Early user reaction was mixed. The ad format felt natural to users accustomed to search advertising but jarring to users who had specifically subscribed to AI tools to avoid ad-supported experiences.

The broader question the test raised is whether an AI assistant that serves sponsored responses can be trusted to give unbiased recommendations. If a user asks ChatGPT to recommend a hotel, a restaurant, or a product, and an advertiser has paid to appear in that context, the alignment between user intent and model output is no longer guaranteed. This is a solvable design problem, but it requires very careful implementation that maintains clear demarcation between organic and sponsored responses.

GPT-4o retires at 18 months

GPT-4o launched in May 2024 and was retired from the standard ChatGPT interface on February 13, 2026, having been the default model for approximately 18 months. This is a short lifespan by software standards. In the context of AI model generations, it reflects how rapidly the field moved in 2025.

At launch, GPT-4o's combination of multimodal capability and low latency was genuinely impressive. By early 2026, its performance on most benchmarks had been surpassed not just by OpenAI's own newer models but by several open-weights alternatives. Keeping the model in the standard interface would have created a confusing two-tier experience where the model most users saw by default was demonstrably less capable than what was available.

The Claude API zero-day

On February 5th, Anthropic disclosed that a security researcher had identified a vulnerability in Claude's API that could be exploited to extract information about system prompts in certain configurations. The vulnerability was classified as a zero-day, meaning it was discovered by a researcher before Anthropic was aware of it, and disclosed responsibly through Anthropic's bug bounty programme.

Anthropic patched the vulnerability and issued the disclosure within 72 hours. The researcher received a bug bounty payment. The incident was handled well by industry standards for responsible disclosure.

The security research community's interest in AI API vulnerabilities had grown significantly through 2025. As AI systems were deployed in increasingly sensitive enterprise contexts, the attack surface expanded. System prompt extraction, jailbreaking, and prompt injection were all active areas of security research, and the economics of responsible disclosure were becoming more favourable as labs invested in formal bug bounty programmes.

Ofcom investigates X over AI content

UK media regulator Ofcom opened a formal investigation into X on February 3rd, citing concerns about the platform's handling of AI-generated nonconsensual content. The investigation was directly connected to the January deepfake crisis involving Grok. Under the UK's Online Safety Act, platforms are required to have effective systems to prevent and remove illegal content. The Grok incidents tested whether X's systems met that standard.

Ofcom's investigation could result in significant fines and, ultimately, in the requirement to implement specific technical measures. The broader implication was that in the UK regulatory framework, liability for AI-generated harm could sit with the platform that distributed or enabled the generation, not only with the individual who created the content.

Reading the pattern

The four stories in February 2026 were connected by a common thread: the AI industry was encountering the full range of challenges that accompany any technology moving from early adoption to mainstream infrastructure. Business model pressure (ads), model obsolescence cycles (GPT-4o), security research (Claude zero-day), and regulatory enforcement (Ofcom on X) are all signs of a maturing industry, not a collapsing one.

The speed at which these issues are arriving is unusual. GPT-4o became obsolete in 18 months. Security researchers are now investing serious time in AI API vulnerabilities, which was barely a research area in 2023. Regulators are issuing formal investigations rather than making inquiries. The technology is being taken seriously, which brings both benefits and scrutiny.