ChatGPT outage and data exposure from a redis-py client bug

A bug in the open-source Redis client library redis-py caused ChatGPT to show some users data belonging to other active users on 20 March 2023, and OpenAI took the service offline to fix it. OpenAI published its account of the outage on 24 March 2023, stating that the exposed data included conversation titles and, for a share of ChatGPT Plus subscribers, partial payment information.

What happened

OpenAI uses Redis to cache user information, and it runs the redis-py library with Asyncio against a Redis Cluster. When a request was cancelled at the wrong moment, a pooled connection could be left corrupted, so the next response on that connection might carry another user's cached data. A server change OpenAI made at 1 a.m. Pacific time on 20 March sharply increased the number of cancelled requests, which raised the odds of that corruption.

Impact

OpenAI said the bug may have made payment-related information of 1.2% of ChatGPT Plus subscribers who were active during a nine-hour window visible to others. The exposed fields were name, email address, payment address, card type, the last four card digits and the card expiry date. Full card numbers were never exposed, according to the company, and it believed the number of users whose data was actually seen by someone else was extremely low. Exposure could occur through subscription confirmation emails sent to the wrong person between 1 a.m. and 10 a.m. Pacific time on 20 March, or through the account management page in the same window. A few hours of chat history were not restored.

Response

OpenAI sent a patch to the Redis maintainers, notified affected users, and added redundant checks so that cached data must match the requesting user. It also reviewed its logs, improved logging, and hardened its Redis cluster against connection errors under heavy load.

Lessons for security leaders

AI services inherit the failure modes of ordinary web infrastructure, so vendor risk reviews of AI tools should cover caching, session isolation and dependency handling, not just model behaviour. Ask providers how they verify that a response belongs to the user who requested it. Keep payment and identity data out of shared caches where possible, and confirm that your AI vendors can identify and notify affected users quickly.