A bug in ChatGPT showed people other users’ chats, and some billing details

On Monday, ChatGPT users started posting screenshots of conversation titles they did not recognize. By Wednesday, OpenAI had confirmed the obvious: this was not a rumor. A bug in an open-source library used by the product let some people see titles from other users’ chat histories. In a narrower window, it also exposed payment-related information.

That is a privacy incident, not a science-fiction story about models “waking up.”

What leaked

OpenAI took ChatGPT offline on 20 March to contain the problem. CEO Sam Altman said a small percentage of users could see titles from another user’s conversation history. Full transcripts were not dumped into other accounts. Titles were.

The worse finding came in the postmortem. During a nine-hour stretch before the outage, the same class of bug could expose billing metadata for about 1.2 percent of ChatGPT Plus subscribers who were active in that window: first and last name, email address, payment address, card type, last four digits, and expiration date. Some subscription confirmation emails generated that morning also went to the wrong person, carrying card type and last four digits.

Full card numbers were not included. That is the only comforting sentence in the paragraph.

Why a sidebar bug matters

ChatGPT is three months old as a mass-market product and already a place people put work, medical questions, legal drafts, and source code. The product stores history so users can resume a thread. That design is convenient. It is also a data store.

A Redis-related mix-up in an AI company is still a mix-up in a company that holds chats and payment records. The model did not “decide” to leak anything. The application stack did what buggy application stacks do.

OpenAI says the library is patched, chat history is coming back, and a slice of Monday’s history may be gone. Users who were active in the payment window should treat unsolicited billing emails and unexpected chat titles as a prompt to watch for phishing, not as proof that their full card number is on a forum.

The part that will age poorly

The interesting security question is not whether OpenAI can fix Redis. It is how many organizations are about to put confidential text into a hosted chatbot whose retention, training, and isolation properties they have not actually read.

This week’s bug was visibility between users. Next month’s problem may be employees pasting things that should never leave the building. Those are different failures. They will get filed under the same headline: “AI privacy.”

Treat ChatGPT like any other SaaS tool that stores what you type. If you would not put the text in a vendor ticket, do not put it in the prompt.