ChatGPT leaked users' data, and nobody hacked it

Nobody attacked it. OpenAI’s post-mortem, published four days later, traces it to a change on its own server, a cancelled request, a pooled connection, and a bug in an open-source library. It is a clean example of a cache being trusted to know whose data it held.

OpenAI used Redis to cache user information “so we don’t need to check our database for every request,” spread across “multiple Redis instances” as a Redis Cluster. Its Python server talked to Redis through redis-py, the open-source client library, and ran on asyncio. The library kept “a shared pool of connections between the server and the cluster,” and recycled a connection for another request once done.

None of that is unusual. The trouble is in what happens to a borrowed connection when its request is cancelled halfway.

With asyncio, OpenAI explains, requests and responses on a connection “behave as two queues: the caller pushes a request onto the incoming queue, and will pop a response from the outgoing queue, and then return the connection to the pool.”

Cancel a request in between and “the connection thus becomes corrupted and the next response that’s dequeued for an unrelated request can receive data left behind in the connection.”

Most of the time that broke loudly: “In most cases, this results in an unrecoverable server error, and the user will have to try their request again.” The dangerous case was quiet: “in some cases the corrupted data happens to match the data type the requester was expecting, and so what gets returned from the cache appears valid, even if it belongs to another user.”

“At 1 a.m. Pacific time on Monday, March 20, we inadvertently introduced a change to our server that caused a spike in Redis request cancellations. This created a small probability for each connection to return bad data.” OpenAI does not say what the change was.

OpenAI took ChatGPT offline and brought it back once the bug was patched, restoring chat history later “with the exception of a few hours of history.”

The same kind of failure had already been reported in public. On 17 March 2023, three days earlier, a developer opened issue #2624 on redis-py: “Canceling async Redis command leaves connection open, in unsafe state for future commands.” Nothing on the record says anyone at OpenAI saw it.

The maintainers merged a fix, #2641, on 22 March, released as 4.5.3. The same day the reporter replied: “I think this only fixed the pipeline, while the race condition still exists in the Redis class… I can still reproduce #2624 using the latest redis-py 4.5.3.” OpenAI’s post-mortem followed on 24 March. On 25 March the reporter opened #2665, calling it “the same issue that recently got a lot of attention due to ChatGPT outage.”

A wider fix, #2666, wrapped commands “with a shield” and shipped in 4.5.4 on 29 March. It did not last. On 20 April a contributor wrote on it, “I believe this PR was a mistake,” pointing to #2695, which undid the change and was released in 4.5.5 on 8 May 2023.

Two CVE records cover the library bug. The first, CVE-2023-28858, notes it “was initially created in response to reports about ChatGPT”; CVE-2023-28859 covers “data leakage across AsyncIO connections in general.”

OpenAI listed six actions: testing the fix, redundant checks on the cache, examining its logs “to make sure that all messages are only available to the correct user,” correlating data sources to identify and notify affected users, better logging, and a more robust Redis cluster.

The one that matters most is the second: “Added redundant checks to ensure the data returned by our Redis cache matches the requesting user.” On 20 March, whatever the server checked did not catch a valid-looking answer that belonged to someone else. The check does not assume the library is fixed or the cache is never wrong. It assumes it might be.

On 30 March 2023 Italy’s data protection authority, the Garante, ordered a temporary limitation on processing Italian users’ data. Its announcement the next day mentioned the breach of 20 March; the order itself rested on other grounds: the information given to users, the legal basis for training data, accuracy, and age checks. On 28 April the Garante reported that OpenAI had made ChatGPT accessible to Italian users again.

In December 2024 the Garante announced a fine of 15 million euros, noting among other things that OpenAI had not notified it of the breach suffered in March 2023. The Garante’s own page now records that a Rome court upheld the challenge to that decision, in a judgment published on 18 March 2026.

Cancelling is a change of state. If code can be interrupted halfway through talking to something, decide what the half-finished conversation leaves behind, and clean it up or throw the connection away.

Check ownership at the boundary. A cache, a queue or a shared pool does not know who is asking. If the answer is about a person, compare it with the person who asked before handing it over.

The quiet failure is the dangerous one. Most of these leftovers caused errors that users retried. The harm was in the rare case that looked like success.

A dependency’s bug tracker is part of your system. Here a report of the same kind of failure was public three days before, the first fix was partial, and the second was later replaced. Read the fix, not just the version number.

Corrections are welcome, and any made are listed, dated, at the end of this article.

No. OpenAI attributes it to a bug in the open-source redis-py library, triggered by a change OpenAI inadvertently introduced to its own server that caused a spike in cancelled Redis requests. Nobody attacked the service.

No. In OpenAI's words, "The bug was discovered in the Redis client open-source library, redis-py." Redis itself worked as designed; the client library left a cancelled request's response in a shared connection.

No. OpenAI says "Full credit card numbers were not exposed at any time." What may have been visible was name, email address, payment address, card type, the last four digits and the expiry date.

It listed six actions, including extensive testing of the fix, redundant checks to ensure the data returned by its Redis cache matches the requesting user, examining its logs, identifying affected users to notify them, better logging, and a more robust Redis cluster.