OpenAI ChatGPT Redis Bug (March 2023): The Race Condition That Exposed Other Users' Conversations

Incident summary

On March 20, 2023, OpenAI took ChatGPT offline after reports that users were seeing titles of other users' conversation history in their sidebar. OpenAI's post-mortem, published four days later under the title 'March 20 ChatGPT outage: Here's what happened,' attributed the exposure to a bug in the redis-py asynchronous client used in ChatGPT's caching layer.

The post-mortem explains that under specific conditions an asynchronous Redis request could be canceled before the response was returned to the client. The cancellation could leave a corrupted connection in the pool, so the next user receiving that connection might read data intended for another user. The exposed fields included conversation titles and the first message of new conversations.

OpenAI's follow-up investigation found that the same bug had also exposed limited payment-related information for approximately 1.2 percent of ChatGPT Plus users who were active during the nine-hour window. Exposed fields named in the post-mortem were first and last name, email address, payment address, the last four digits of a credit card number, and the credit card expiration date. Full credit card numbers were not exposed.

Failure technique

The root cause was a race condition in an open-source dependency, not a flaw unique to OpenAI's code. The redis-py library is widely used across the Python community. The bug was triggered by asynchronous request cancellation interacting with the connection pool. OpenAI's reproduction steps were shared with the redis-py maintainers and the upstream patch shipped.

From a system-design angle, the incident illustrates how cross-tenant isolation can be undermined by infrastructure choices that look local. A connection pool that may return a partially-read connection to a different user is a tenant-isolation surface even though developers usually treat it as plumbing. AI infrastructure roles need to enumerate every such surface before launching a multi-tenant system.

The failure also surfaced a privacy-engineering question that AI engineering teams continue to face. The redis-py bug existed before ChatGPT was built. The exposure became significant because ChatGPT routed user conversation state through that infrastructure at scale. Any production AI feature that handles user content inherits the privacy posture of every layer below it.

Impact and consequences

The direct technical impact was bounded by OpenAI's response: the system was taken offline within hours, the bug was reproduced and patched, and the post-mortem was published within four days. Users affected by payment-information exposure were notified individually per OpenAI's commitment.

The regulatory consequence was significant. On March 30, 2023, the Italian Data Protection Authority (Garante per la protezione dei dati personali) issued a provisional order limiting OpenAI's processing of Italian users' data, citing the incident and broader concerns about lawful basis under the GDPR. OpenAI responded by adding additional disclosures and an age-verification step. The Italian order remains the canonical regulator response to this incident.

Industry-wide, the incident sharpened enterprise scrutiny of consumer AI tools handling proprietary data. The Samsung internal restriction announced weeks later (see /decipher-files/samsung-chatgpt-data-leak) is one of several enterprise responses traceable in the public record.

Lessons for builders

Treat every infrastructure dependency as a tenant-isolation surface, not just the components labeled multi-tenant. Connection pools, caches, load balancers, and async runtimes can all leak across users under failure conditions that the dependency authors did not test.

Maintain a written tenant-isolation threat model for the production AI surface. Enumerate every component that might serve data from one user to another. Define the verification step for each. The redis-py issue would have been visible to a model that asked the question explicitly.

Run cross-tenant differential testing in the regression suite. The simplest version is a test that opens two sessions with distinct content and asserts that neither session can see the other's data. Variants of the test should target the connection pool, the cache layer, and the request middleware.

Stage a public, technically credible post-mortem for any incident with privacy impact. OpenAI's same-week publication is one reason the case is still useful to the field. Reaching the same bar means standing up the documentation pipeline before an incident, not during one.

Mitigations

What builders should put in place to address the failure pattern. Each mitigation maps to operational practice the relevant Applied AI roles own.

Related Applied AI roles

The Applied AI roles whose day-to-day work would have prevented, detected, or contained this incident.

• AI Engineer: An AI Engineer builds production cybersecurity-relevant AI systems integrating LLMs, embeddings, and retrieval pipelines.
• AI Platform Engineer: An AI Platform Engineer builds internal platforms enabling AI development at scale across an organization.
• AI Infrastructure Engineer: An AI Infrastructure Engineer manages cloud and compute infrastructure for AI workloads at scale.
• AI Reliability Engineer: An AI Reliability Engineer ensures production AI systems meet service-level objectives across uptime, latency, and quality.

Cybersecurity Decipher File parallel

Related AI Decipher Files

• Samsung ChatGPT Data Leak: When Consumer AI Became an Enterprise Exfiltration Channel
• Microsoft Tay (2016): The 16-Hour Lesson That Defined Responsible AI Deployment

Frequently asked questions