OpenAI announces that a bug exposed sensitive ChatGPT user data

The ChatGPT bug from a few days ago was more serious than initially reported. Personal data of ChatGPT Plus subscribers may have been exposed.

A few days ago, OpenAI was forced to unplug its popular conversational robot (chatbot) ChatGPT after a user managed to exploit a vulnerability in the system to retrieve the conversation title history of other users. The company has now shared its initial findings regarding this incident, which turned out to be more severe than initially announced.

The ChatGPT bug from a few days ago was more serious than initially reported

In the early week incident, users posted screenshots on Reddit of their ChatGPT sidebar displaying previous conversation titles from other users. Only titles. In response to this widespread issue, OpenAI decided to unplug its chatbot, resulting in a service interruption that lasted nearly 10 hours while they investigated the matter. The results of this analysis revealed a significant security problem: the conversation history bug could have also disclosed personal data of about 1.2% of ChatGPT Plus subscribers – the $20 per month subscription.

“In the hours leading up to ChatGPT’s unplugging, it was possible for some users to see the first name, last name, email address, billing address, the last four digits, and the expiration date of other active users’ credit cards. Full credit card numbers were never exposed,” explains the OpenAI team. The problem has been fixed, with the flaw residing in a third-party open-source library of the Redis client, redis-py.

Personal data of ChatGPT Plus subscribers may have been exposed

The company, however, sought to downplay the extent of this disclosure, clarifying the criteria that had to be met for this personal data to be effectively exposed: “Open a registration confirmation email sent on Monday, March 20, between 1 am and 10 am (Pacific Time). Due to the bug, some of these emails generated during this time window were sent to the wrong users. These emails contained the last four digits of the credit card number but not the full number. It is possible that a few confirmation emails may have been sent before March 20, but we have no confirmed cases of this.” Another possible scenario: “In ChatGPT, click on ‘My Account,’ then ‘Manage My Subscription’ between 1 am and 10 am (Pacific Time) on Monday, March 20. During this time window, the first name, last name, billing address, the last four digits, and the expiration date of another active ChatGPT Plus user’s credit card may have been visible. It is possible that this could have occurred before March 20, but we have no confirmed cases of this.”

The company has taken additional steps to prevent this bug from recurring, including adding redundant checks when calling libraries of this kind, “systematically reviewing our logs to ensure that all messages are only accessible to the correct users,” and “improving logs to identify when such an incident occurs and accurately confirm when it has disappeared.” The company also states that it has contacted affected users about the issue.