Media & Culture

ChatGPT Leaking User chats across accounts?

Subscribers report seeing strangers' prenatal vitamin research chats appearing in their accounts overnight.

Deep Dive

OpenAI is investigating alarming reports from ChatGPT Plus subscribers who claim the platform is leaking private conversations between user accounts. One user, a subscriber since 'virtually day 1,' woke to find detailed chat histories about prenatal vitamin market research that weren't theirs appearing in their account interface. The conversations, which occurred between 12:30 AM and 6:30 AM, consistently began with the instruction 'do not update memories' and described the user as 'an older woman researching vitamins.' Despite having two-factor authentication enabled, resetting passwords twice, deleting API keys, and logging out of all devices, the foreign chats continued to appear intermittently in both web and mobile applications.

Technical analysis suggests this isn't a conventional security breach, as the affected user found no evidence of account compromise, browser hijacking, or suspicious logins. The chats would appear live when left on screen but disappear upon refresh, only to be replaced by new foreign conversations. OpenAI's initial support responses focused on standard account security measures, but the persistence and specificity of the issue—coupled with its occurrence across multiple platforms—point toward a potential backend data isolation failure. The incident raises serious questions about ChatGPT's conversation segregation mechanisms and whether private user data is being improperly routed or displayed between accounts, highlighting critical vulnerabilities in AI chat platform architectures that handle millions of simultaneous conversations.

Key Points
  • ChatGPT Plus subscriber found detailed prenatal vitamin market research chats from another user in their account
  • Foreign chats appeared between 12:30-6:30 AM and consistently started with 'do not update memories'
  • Issue persisted despite 2FA, password resets, and API key deletion across both web and mobile apps

Why It Matters

Potential platform-side data leak could compromise confidential business research and personal conversations for 100M+ users.