OpenAI says a bug leaked delicate ChatGPT person information

“Within the hours earlier than we took ChatGPT offline on Monday, it was doable for some customers to see one other lively person’s first and final identify, e-mail deal with, cost deal with, the final 4 digits (solely) of a bank card quantity, and bank card expiration date. Full bank card numbers weren’t uncovered at any time,” the OpenAI staff wrote Friday. The problem has since been patched for the defective library which OpenAI recognized because the Redis shopper open-source library, redis-py.

The corporate has downplayed the probability of such a breach occurring, arguing that both of the next standards must be met to position a person in danger:

– Open a subscription affirmation e-mail despatched on Monday, March 20, between 1 a.m. and 10 a.m. Pacific time. Because of the bug, some subscription affirmation emails generated throughout that window had been despatched to the incorrect customers. These emails contained the final 4 digits of one other person’s bank card quantity, however full bank card numbers didn’t seem. It’s doable {that a} small variety of subscription affirmation emails may need been incorrectly addressed previous to March 20, though we have now not confirmed any situations of this.

– In ChatGPT, click on on “My account,” then “Handle my subscription” between 1 a.m. and 10 a.m. Pacific time on Monday, March 20. Throughout this window, one other lively ChatGPT Plus person’s first and final identify, e-mail deal with, cost deal with, the final 4 digits (solely) of a bank card quantity, and bank card expiration date may need been seen. It’s doable that this additionally may have occurred previous to March 20, though we have now not confirmed any situations of this. 

The corporate has taken extra steps to forestall this from taking place once more sooner or later together with including redundant checks to library calls, “programatically examined our logs to guarantee that all messages are solely obtainable to the proper person,” and “improved logging to establish when that is taking place and totally verify it has stopped.” The corporate says that it has additionally reached out to alert affected customers of the difficulty.

This information follows a costly public faux pas committed by Google’s rival Bard AI in February when it incorrectly assured Twitter that the JWST was the primary telescope to picture an exoplanet, in addition to revelations that CNET had surreptitiously used generative AI to write financial explainer posts (per week earlier than laying off a sizable chunk of its editorial department). Whether or not OpenAI will undergo the identical market-based repercussions as its rivals stays to be seen.