The Redis Bug That Showed ChatGPT Users Each Other's Chats
On 20 March 2023, OpenAI took ChatGPT offline after users reported seeing conversation titles that were not theirs in the sidebar. The cause was not a novel AI vulnerability at all. It was a race condition in an open-source caching library — the kind of bug that has haunted web applications for decades, surfacing here in one of the most-used AI products in the world.
In its post-incident write-up, OpenAI explained that the bug lived in redis-py, the Python client it used for caching. Under specific conditions — a cancelled request at the wrong moment — a connection could be returned to the pool in a corrupted state, so that a subsequent request received data belonging to a different, unrelated user pulled from the cache.
What actually leaked
Two distinct exposures occurred. The first, and most visible, was chat history: users could see the titles of other active users' conversations, and in some cases the first message of a newly created conversation, if two people were active at the same moment.
The second was more sensitive. OpenAI determined that the same bug may have exposed payment-related information for roughly 1.2% of ChatGPT Plus subscribers active during a nine-hour window. The exposed fields could include another user's first and last name, email address, payment address, credit-card expiry date, and the last four digits of the card number. Full card numbers were never exposed.
request B reuses that connection → receives A's cached data instead of its own
An LLM app is still a web app
It is tempting, with any AI system, to focus threat modelling on the model — jailbreaks, prompt injection, training-data leakage. This incident is a useful corrective. An LLM application is still a web application. It has caches, session handling, connection pools, payment integrations, and every one of the concurrency and state-management pitfalls those entail. The novel attack surface sits on top of a very conventional one that does not stop mattering.
The lesson defenders keep relearning
- Audit the plumbing, not just the prompt. Caching layers, session isolation, and connection pooling deserve the same scrutiny in an AI product as in a bank's web front end.
- Assume shared infrastructure can cross tenants. A caching bug that mixes users is a tenant-isolation failure. Test explicitly for one user receiving another's data under load and cancellation.
- Log enough to scope a leak. OpenAI could quantify who was affected and notify them. The ability to bound an incident precisely is worth building before you need it.
- Track your dependencies. The flaw was upstream, in a widely used library. Your risk inventory includes code you did not write but did ship.
OpenAI patched the issue, contributed a fix upstream, and contacted affected subscribers. The episode did no lasting damage, but it landed at a delicate moment — days before Italy's data-protection regulator moved to restrict the service. For defenders, the takeaway is unglamorous and durable: the exotic risks of AI do not displace the ordinary ones. You still have to secure the web app the model is riding on, and you cannot secure infrastructure you have not fully mapped.