ChatGPT Redis bug exposes user chat histories and payment data
Date: 2023-03
Affected: OpenAI ChatGPT subscribers
Attack vector: data-exfiltration
Category: real-world
Severity: High

A bug in the open-source Redis client library used by ChatGPT briefly exposed other users' chat-history titles and, for a subset of paying subscribers, names, email addresses, billing addresses, last-four digits of credit cards and expiry dates. OpenAI took ChatGPT offline to patch and disclosed the incident.


Mitigations:

Architectural layers (MAESTRO):