Incident·WS-0006·Mar 20, 2023·disclosed Mar 24, 2023 (4 days later)·in the wild·Privacy & data leaks

ChatGPT bug exposes users' chat titles and payment details

OpenAI / ChatGPT (redis-py client bug)

28/100

WS-2 Moderate

Harm score 45, signal score 8. Autonomy: tool (a person misused it). How the scores work.

Harm 2/5

damage actually done

Reach 3/5

who was affected

Autonomy 0/4

how much the AI did on its own

Novelty 1/5

how new the behavior was

Permanence 2/5

how hard it is to undo

A race condition in the open-source redis-py library let some ChatGPT users see other users' conversation titles and, for some Plus subscribers, partial billing details during a nine-hour window. OpenAI took ChatGPT offline, patched the library and notified affected users.

Damage

~1.2% of ChatGPT Plus subscribers active 01:00-10:00 PT on Mar 20 may have had name, email, payment address, card type, last 4 digits and expiry exposed; full card numbers not exposed

Sources

OpenAI, second source. Conventional infrastructure bug at an AI provider rather than model behavior. Cited by Italy's Garante in its 30 Mar 2023 temporary ChatGPT ban.

Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.