TikTok bringing agentic shopping tools to advertisers, OpenAI preparing to test ads inside ChatGPT image generation, and a Ninja Forms campaign that plants admins owners cannot see
Today's 3 verified stories: at Advertising Week New York 2026, TikTok announced agentic tools such as Buy Direct, Shopping Assistant and Agentic Leads, and opened TikTok Ad Network to US advertisers. On October 5, 2026 OpenAI announced a new visual format for ChatGPT Ads that will appear while Free and Go users generate images, with testing starting in October in the US with a first group of advertisers. Patchstack documented a campaign that pushes the same script through stored XSS bugs in Ninja Forms and WPC Product Bundles for WooCommerce, installing a fake plugin and adding an admin account that never shows up on the Users screen. The detailed look at each story, its sources and what it means for your business lives on its own page.
TikTok brings agentic shopping and ad tools to advertisers
In a post timed for Advertising Week New York 2026, TikTok introduced agentic tools for advertisers, with the shopping features announced on October 5, 2026 according to TechCrunch. Buy Direct offers one-click in-app checkout from the For You feed, and Shopping Assistant handles product details, shipping, sizing and availability in one chat. Agentic Leads is set to capture prospects in TikTok Direct Message and in lead forms on advertisers' own websites. TikTok Ad Network is now open to US advertisers and reaches close to 400,000 apps. Search Ads Campaign now runs on Smart+, GMV Max will account for affiliate commissions and coupons, and TikTok for Business MCP works as a connector on Claude, Perplexity, Replit and other platforms.
OpenAI brings a visual ad test into ChatGPT image generation
On October 5, 2026 OpenAI announced a new visual ad format for ChatGPT, which by the company's own count reaches 1.2 billion people every week. At first it appears only during image generation and only for people on the Free and Go plans; every ad is clearly labeled and kept apart from the user's picture. Testing begins in October in the US with an initial set of advertisers. On measurement, Hightouch, Tealium and LiveRamp integrations arrive, partners such as AppsFlyer, Triple Whale and Adjust support attribution and reporting, and OpenAI is working with Haus, Measured and WorkMagic on geo-based incrementality experiments. Negative Phrases are open to qualifying advertisers, and suitability pilots are under way with DoubleVerify and Integral Ad Science.
Ninja Forms and WPC Product Bundles flaws are being used to plant admin accounts owners cannot see
On October 6, 2026 Patchstack documented a campaign pushing one JavaScript payload through stored XSS bugs in Ninja Forms (CVE-2026-94504, 3.15.3 and earlier) and WPC Product Bundles for WooCommerce (CVE-2026-93836, 8.6.6 and earlier). When an administrator opens the tainted content, the script uses that session to install a fake plugin called WP Smart Thumbnails and add an admin account hidden from the Users screen, kept alive by must-use plugins in wp-content/mu-plugins. As BleepingComputer reports, updating leaves an existing infection in place. The recommended steps are moving Ninja Forms to 3.15.4 and WPC Product Bundles to 8.6.7 or later, searching logs for imgcdn1.com and listing administrators directly from the database.
The agenda moves fast, the system stays calm.
Let us talk about what these shifts mean for your business and work out together which step fits you.