We took ChatGPT offline earlier this week due to a bug in an open-source library which allowed some users to see titles from another active user's chat history. [...] Upon deeper investigation, we also discovered that the same bug may have caused the unintentional visibility of payment-related information of 1.2% of the ChatGPT Plus subscribers who were active during a specific nine-hour window. [...] Everyone at OpenAI is committed to protecting our users' privacy and keeping their data safe. It's a responsibility we take incredibly seriously. Unfortunately, this week we fell short of that commitment, and of our users' expectations.
Curated from openai.com · 24 March 2023 →
On 20 March 2023 ChatGPT users began seeing other people's conversation titles in their own sidebars. OpenAI took the product down, and its postmortem traced the fault to redis-py, the open-source Redis client: cancelled requests could leave a connection returning another user's cached data. The same bug sent subscription confirmation emails to the wrong people, exposing names, email and billing addresses, card type, card expiry and the last four digits for 1.2% of Plus subscribers active in a nine-hour window. OpenAI patched it, sent the fix upstream to the Redis maintainers and notified the affected users. It is the earliest company-published account of an AI product leaking one customer's data to another, and the cause was a caching bug rather than the model.
