A cancelled request showed ChatGPT users other people's chat titles

A stranger's chat titles in your sidebar

On Monday, 20 March 2023, some people who opened ChatGPT found conversations in their history that were not theirs. The sidebar down the left of the screen lists each past chat by a title drawn from its first message. For a stretch of that day, titles belonging to another active user showed up in the list instead.¹

That was the visible part. Over the four days that followed, OpenAI traced the fault and disclosed that the same bug had also exposed payment details belonging to a slice of its paying subscribers.¹ Neither problem was in the model that writes the answers. Both were in the layer that stores them.

How one request ends up reading another's answer

To keep ChatGPT responsive, OpenAI put a cache in front of its slower stores: a fast, in-memory holding area for data the server has looked up recently, so it does not have to fetch the same thing twice. The cache software is Redis, an open-source data store used across the industry.¹

A service handling many requests at once does not open a new connection to Redis for each one. It keeps a set of open connections and lends a free one to each request, then takes it back when the request is done. That set is a connection pool.¹ The trouble starts when a request is abandoned before it finishes, which happens constantly at scale: a user closes the tab, or the server gives up on a slow call and cancels it. Early on 20 March, a change OpenAI made caused a sudden spike in these cancellations.¹ In OpenAI's account, "At 1 a.m. Pacific time on Monday, March 20, we inadvertently introduced a change to our server that caused a spike in Redis request cancellations. This created a small probability for each connection to return bad data."¹

Here is how one cancellation returns bad data. The server takes a connection from the pool, sends its command to Redis, and waits to read the reply. The redis-py client that OpenAI used to talk to Redis holds commands it sends in one queue and replies it receives in another. If the request is cancelled in the gap after its command was sent but before its reply is read, the connection goes back into the pool still carrying that unread reply. The next request handed that same connection sends its own command, reads the first reply waiting for it, and gets the previous request's leftover data.¹²

A developer outside OpenAI had reported the same fault against redis-py three days before the incident, on 17 March. The report is titled "Off by 1" and traces the sequence step for step: after a cancelled command, "the following redis operation on the same connection will send the command, and then promptly continue to read the response from the previous, canceled command."² Under the cancellation spike on 20 March, that off-by-one misdelivery happened often enough that one user's cached data surfaced in another's session.¹

OpenAI took ChatGPT offline that day, patched its own systems, added checks that the data coming back from the cache belongs to the user who asked, and contributed a fix upstream.¹ The redis-py maintainers merged it on 22 March: it shields a command from cancellation, so a request cancelled midway resets its connection instead of returning it to the pool dirty.³

One fix did not settle it. On 25 March the same reporter opened a follow-up, noting that the shielding covered only pipelined operations and that a single cancelled command outside a pipeline could still corrupt a pooled connection.⁴ Closing the fault took a second round.

Chat titles first, card details four days later

When ChatGPT went dark on 20 March, OpenAI did not say why. It put the outage down to a bug without naming the cause; the payment-data disclosure came only with the postmortem on 24 March.⁵ Sam Altman, OpenAI's chief executive, wrote at the time, "We feel awful about this."⁵

The reported scope grew as the investigation went. The first exposure was the chat titles, and the first message of a newly created conversation could also appear in another user's history if the two were active at the same moment.¹ Deeper investigation found that the same bug had exposed payment-related information for 1.2% of the ChatGPT Plus subscribers who were active during a nine-hour window that morning, from 1 a.m. to 10 a.m. Pacific.¹

That 1.2% is a ceiling, not a count. It measures how many active subscribers could have been shown another person's data in that window, not how many actually were; OpenAI said separately that the number of users whose data was actually seen by someone else was extremely low.¹

What a subscriber might have seen depended on the route. Some were sent a subscription-confirmation email meant for a different user, carrying that user's credit card type and the last four digits of the number. Others, on the "Manage my subscription" page, saw another active subscriber's first and last name, email, payment address, card type, last four digits, and expiration date.¹

Italy blocks ChatGPT, on other grounds

Ten days later, ChatGPT stopped working in Italy. On 30 March 2023 the Garante, Italy's data-protection authority, ordered a provisional limitation on OpenAI's processing of the personal data of users in Italy, effective the moment OpenAI received it, using the GDPR's power to impose urgent measures.⁶

Much of the coverage said the regulator acted over the breach.⁷ The order's own text does not. It sets out four grounds, and the 20 March breach is not among them. OpenAI gave users no information notice and had no adequate legal basis for collecting personal data at scale to train the model. It processed inaccurate data because the model's outputs do not always match reality, and it ran no age check on a service its terms reserve for users 13 and older.⁶

Where the breach does appear is the Garante's press release the next day, as background to the action: it recorded that on 20 March ChatGPT had suffered "a data breach affecting ChatGPT users' conversations and information on payments by subscribers to the service."⁸ The breach shaped the episode without grounding the order.

The block held for about four weeks. The breach became a formal violation only later, in the Garante's decision of 2 November 2024, as a failure to notify the authority; the same decision fined OpenAI €15 million. That fine no longer stands: the Court of Rome annulled the decision in a judgment published 18 March 2026, upholding OpenAI's appeal.⁹

1. 30 Mar 2023

   The Garante orders a halt⁶

   A provisional limit on OpenAI's processing of Italian users' data, in force from the moment the order arrives.

2. 28 Apr 2023

   ChatGPT returns to Italy¹⁰

   OpenAI adds a privacy notice, an opt-out from training on conversations, and an age gate at sign-up, and the Garante lifts the block.

3. 2 Nov 2024

   A €15 million fine⁹

   The Garante closes its inquiry, finds a failure to notify the breach among other violations, and fines OpenAI. Announced that December.

4. 18 Mar 2026

   The fine is annulled⁹

   The Court of Rome upholds OpenAI's appeal, and the Garante removes the decision from its site.

The same flaw, wherever state is cached

Nothing about this failure needed an AI. The bug lived in redis-py, an open-source client that many services use to reach Redis, and it was found by a developer with no connection to OpenAI.² The ingredients are common: a cache holding per-user data, a pool of connections shared across requests, and requests that can be cancelled before they finish. Any busy service built that way can leak one user's data into another's session, whether it runs a chat window, an inbox, a bank account, or a store's checkout.¹²

An AI product sits on this same web plumbing, and a regulator will treat a leak from it as a data-protection event wherever in the stack it began.⁶⁹ None of it needs a model to hand one person another's data.