March 20 ChatGPT outage: Here’s what happened
OpenAI
OpenAI just published a post-mortem on the March 20 ChatGPT outage. A caching bug briefly let some users see snippets of other people's chat titles and payment info.
Based on reporting by OpenAI — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
OpenAI finally laid out what actually broke on March 20th, and the short version is uncomfortable: an open-source library called redis-py, used to manage a cache of user sessions, had a bug that under heavy load could hand one person a peek into someone else's data. Not a hack, not an attacker probing the system. Just bad luck colliding with a race condition that had apparently gone unnoticed until ChatGPT's traffic got big enough to trigger it reliably.
The practical fallout was narrow but real. For about nine minutes, some users saw the titles of other users' conversation history pop up in their own sidebar. Worse, OpenAI says a subset of active ChatGPT Plus subscribers had payment-related details exposed to other users during a roughly one-hour window before the fix went out — first and last name, email address, payment address, and the last four digits of a credit card, along with the card's expiration date. Full card numbers were never exposed, which is the one mercy in this story.
OpenAI's response was to pull ChatGPT offline entirely once the scope became clear, patch the redis-py bug, and then spend time auditing the cache and the surrounding code before flipping the service back on. The company says it has since added redundant checks to verify that any data pulled from that cache actually belongs to the user requesting it, plus improved logging so a bug like this gets caught faster next time. They also notified the Plus subscribers whose payment info was potentially exposed.
What stands out here isn't the bug itself — race conditions in caching layers are a known hazard, and any company running infrastructure at this scale will eventually hit one. It's that a piece of open-source plumbing, not some exotic AI failure mode, was the weak link in a product whose entire pitch is trustworthy AI. The postmortem reads like standard incident-response boilerplate, but the underlying lesson is that ChatGPT's growing pains look a lot like every other fast-scaling web service's growing pains, minus the AI mystique.
My take — AI-written commentary, not fact-checked reporting
I'll give OpenAI credit for publishing specifics instead of a vague apology, but let's not pretend this was some AI-safety near-miss — it was a mundane caching bug, the kind that plagues every startup that scales too fast without enough load-testing on third-party dependencies. The real story is that a company racing to ship AI features at breakneck speed is running on infrastructure that wasn't ready for its own success, and that gap is going to show up again somewhere else.
Read more about this at: OpenAI