how it happened
- whoOpenAI changespike in cancelled requests
- the gapredis-pyreply sent to the wrong user
- the result1.2% of Plus usersnames, emails, card last four
what everyone assumed
A chat session feels like a private space because that is how it is built to feel: your account, your window, your history, addressed to you alone. It is reasonable to treat it the way you treat a private document, because every cue in the interface says it is one. The privacy feels like a property of the conversation itself, rather than a property of the plumbing underneath it.
what happened
Here the quiet stretch was a single window of hours on 20 March 2023, the time the fault ran before the service was taken offline. A change OpenAI introduced caused a spike in cancelled requests against a Redis client library, and a bug in that library, in redis-py, meant a cancelled request could occasionally hand its response to the wrong open connection. The effect surfaced first as chat titles from other users appearing in someone’s history. The deeper part of the same fault touched billing.
step by step
- 20 March 2023a change spikes cancelled requestsThey hit the redis-py client library.
- a bug hands responses to the wrong connectionOther users' chat titles appear in people's history.the assumption breaks here
- billing details leak the same wayName, email, payment address, last four card digits and expiry for 1.2 percent of active Plus users.
- ChatGPT is taken offlineOpenAI traces the cause and publishes a post-mortem. Full card numbers are never exposed.
how it surfaced
OpenAI took ChatGPT offline, traced the cause, and published a post-mortem. The bug may have exposed payment-related information of 1.2 percent of ChatGPT Plus subscribers who were active during a roughly nine-hour window: a first and last name, an email address, a payment address, the last four digits of a card, and an expiry date. Full card numbers were never exposed. The assumption retired itself in that sentence: the private session had a shared layer underneath it.
A session that feels private to you is still running on infrastructure shared with everyone else using it.
The boundary between your data and the next person’s is held by code, and code has the failure modes code has.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersA bug at the vendor shows some of your data to other customers for a few hours.what it costs youYou did nothing wrong, and you still have to work out what was exposed and tell people.
- or it goes like thisit happenedSamsung, 2023howEngineers paste code and notes into a free chatbot to get help.what leavesconfidential code and meeting noteswho ends up with itan AI vendor on consumer terms
- or it goes like thisit happenedDeepSeek exposed database, 2025howThe AI vendor leaves its own database open.what leaveseveryone's chats and the vendor's keyswho ends up with itanyone on the internet
sources
your turn
what you can do about it
this week
Look at one AI tool your team pastes real work into, and find out what the provider actually says about where that data goes and how tenants are kept apart, rather than what the interface implies.
Somewhere in your company, people are typing things into an AI tool that they would only type into a private space, because the window makes it feel private. The question the quiet hours ask is what sits underneath that window.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →