// this week in AI

This week in AI: one ChatGPT budget, the shared-link flaw and malware that asks AI what you're worth

By Trinity · MariVisionNovember 3, 20267 min read
Ale from MariVision in a huge dark newsroom, under a curved wall of holographic screens showing a fuel gauge, a broken chain, a bug with a price tag, a downward arrow and a small delivery robot
2026 · 11 · 03 — THIS WEEK IN AIChatGPT changes its limits, shared links become a risk and malware uses AI to pick who to rob

OpenAI just changed two things that matter if you use ChatGPT for work: the Chat and Work tabs are becoming one, and starting in December your usage limits will be shared with Codex. Meanwhile, a flaw that let attackers read the private chats of anyone who opened a shared link has been patched.

On the security front, Cisco Talos described malware that uses artificial intelligence to size up how much each victim is worth. And two numbers show where the market is really heading: Reddit is losing more than a million Google visits a week, while DoorDash has received only a few hundred orders from AI agents. For each story: what happened and why it matters to you.

1 · ChatGPT merges Chat and Work and shares limits with Codex starting in December

Huge dark open-plan office with empty desks, a holographic chat window and a code window merging into a single panel near the ceiling, with a fuel gauge at half

In an email to users, OpenAI announced that in the ChatGPT desktop app the Chat and Work tabs are becoming a single experience, with files and plugins, designed to take an idea from first draft to finished work. A select group of users gets it first, then it rolls out to everyone. Codex stays separate.

The most concrete change is about usage: ChatGPT and Codex will draw from the same usage allowance. According to Crypto Briefing, the switch starts in December for the Plus, Pro and Business plans. OpenAI says most users won't notice a difference, but some will have to wait for their limits to reset more often.

Why it matters to you: if someone on your team uses ChatGPT for emails and quotes and someone else uses Codex for small scripts, starting in December you're all drawing from the same tank. Figure out who uses what, and how much, before you run dry in the middle of the day. If you want to organize AI use in your business without waste, let's talk about it in an AI consulting session for SMEs.

2 · ChatGPT patches a shared-link flaw that exposed private chats

Dark server corridor with a huge holographic chain hanging near the ceiling, a broken link spilling chat bubbles and a glowing padlock sealing the crack

Researchers at security firm Parameter found that a specially crafted ChatGPT share link could run code in the session of whoever opened it: the attacker could see the list of recent conversations, open a private chat that was never shared and send its contents to an outside server. All it took was opening the link and clicking Preview once.

The flaw was reported on October 18; OpenAI rated it high severity and fixed it by October 26, paying a $5,000 bounty. There are no reports of real-world attacks and users don't need to do anything.

Why it matters to you: AI chats end up holding quotes, contracts and client data, exactly what an outsider would want to read. This time it ended well, but your team needs clear rules on what gets pasted into ChatGPT and caution with chat links shared by strangers.

3 · VOLTA, the malware that steals your passwords and then asks an AI what the victim is worth

Abandoned bank vault room with holographic keys, credit cards and cookies weighed on a huge glowing scale with a price tag

Cisco Talos described VOLTA, a Windows program that steals passwords, cookies and cards saved in the browser, crypto wallets, cloud service keys and even Wi-Fi passwords. It then uses the stolen sessions to grow the haul, for example by searching the victim's Gmail for receipts to confirm their home address.

What's new is the next step: the collected data is sent to an artificial intelligence model, asked to act as an “analyst” and rank what can be monetized and how well protected the victim is. If one model refuses, the malware tries another. Then it deletes itself.

Why it matters to you: passwords saved in the browser on your office computer are the first thing stolen, and AI helps criminals quickly figure out who's worth targeting. Two-factor authentication on your key accounts, a password manager instead of the browser and, if a PC gets infected, revoke all sessions right away and change every password.

4 · Reddit loses more than a million Google visits a week and shuts out anonymous users

Huge dark library with empty reading tables, a holographic search bar floating near the ceiling with a traffic chart and a closed door with an access keypad

Reporting its third-quarter results, Reddit said that in October visits from search engines fell by an average of more than a million a week, and that daily active users in the US dropped from 53.2 to 50.7 million. Among the causes: AI-generated answers that keep people inside Google.

Reddit's answer is a site that's increasingly accessible only to logged-in users, to protect its content from AI that copies it and to license it instead. Tests start this quarter in some markets outside the US. Meanwhile the numbers look good: revenue at $895 million, up 53%.

Why it matters to you: if even one of the most visited sites in the world is losing Google traffic, a business website can't live on organic search alone. Direct contacts, a newsletter and pages that clearly answer your customers' questions, the ones AI tools quote. To see where you stand, try a free SEO analysis of your site.

5 · DoorDash: only a few hundred orders from AI agents

Huge empty, dark restaurant kitchen with steel counters, a holographic delivery robot holding a single bag next to an enormous stack of delivery boxes

In its quarterly earnings presentation, DoorDash admitted it has so far received only “several hundred” orders from AI agents, meaning third-party assistants that order on the user's behalf. For a sense of scale: in 2025 the company averaged about 3 million deliveries a day.

CEO Tony Xu warned against unrealistic expectations: nearly all customers still order through the DoorDash app. The company keeps experimenting, though, and down the road it could sell ads right inside the agents.

Why it matters to you: there's a lot of talk about customers shopping through their AI assistant, but for now the numbers are tiny. Before investing in a store “for agents,” fix the channels your customers actually use: a fast website, an up-to-date business listing and an online store that's easy to use on a phone.

In short

ChatGPT becomes a single workspace and shares limits with Codex starting in December: better to know who's using what. The shared-link flaw is already patched, but it's a reminder of how valuable the data we put into chats is, and VOLTA shows that criminals use AI to pick their victims too. Finally, Reddit and DoorDash tell two opposite truths: AI answers are already taking traffic away from websites, while purchases made by agents are still a niche. The rule: protect your accounts, don't depend on a single channel and invest where your customers are today.

Sources: TechCrunch (ChatGPT merges Chat and Work) · Crypto Briefing (limits shared with Codex from December) · The Hacker News (ChatGPT shared-link flaw) · Cisco Talos (VOLTA) · TechCrunch (Reddit) · TechCrunch (DoorDash and AI agents)

Frequently asked questions

What changes for ChatGPT and Codex users starting in December?

Starting in December, ChatGPT and Codex will draw from the same usage allowance, according to reports covering the Plus, Pro and Business plans. OpenAI says most users won't notice, but if you use both heavily you may have to wait for your limits to reset more often.

Do I need to do anything about the ChatGPT shared-link flaw?

No. OpenAI fixed the issue by October 26 and there are no reports of real-world attacks: the fix is server-side, so there's nothing to install or change. The usual caution still applies: don't open shared chat links from strangers and don't paste confidential client data.

How do you protect yourself from malware like VOLTA?

VOLTA mainly steals passwords, cookies and cards saved in the browser on Windows. What helps: two-factor authentication on your key accounts, a password manager instead of saving passwords in the browser and, if a machine gets infected, revoking all sessions right away and changing every password.

Want to use AI in your business without exposing your clients' data?
A half-hour chat, no strings attached, plain talk, no jargon
Let's talk →