So this happened over the weekend and I don't think it's gotten nearly enough attention because GPT-4 sucked all the oxygen out of the room last week. On Monday OpenAI took ChatGPT completely offline for a few hours. Not a "we're experiencing high demand" banner, an actual full outage. Turns out there was a bug in an open-source library they use (redis-py, if you care about that kind of thing) that caused some people to see chat titles from other users' conversation histories in their own sidebar. Weird enough on its own. But then it got worse: for a window of about nine hours on the 20th, some ChatGPT Plus subscribers' payment information leaked too, last four digits of the card, name, email, expiration date. Not full card numbers, thankfully, but still.
I pay for Plus. Have since it launched. So naturally the first thing I did when I saw the news was go check my email for a breach notice, which hadn't arrived yet, and then spent about twenty minutes doing that thing where you're not sure if refreshing your inbox is going to make you feel better or worse. It didn't arrive that day. I think I got the actual notification two days later, which, fine, I get that these things take time to sort out internally, but if my billing info might be floating around I'd like to know before I read about it on a tech blog, not after.
Here's the thing that actually bugs me about it though, more than the bug itself. Bugs happen. Any engineer who's shipped anything at scale knows that a library-level caching issue can absolutely blindside you, and the class of bug here (a cache serving stale or wrong data across requests) is a genuinely old and boring failure mode that's bitten basically every company running a request cache at any size. What bugs me is how casually a lot of the coverage treated it, like this was a minor footnote to "GPT-4 is here and it can pass the bar exam." A company that a huge percentage of the internet is now feeding personal writing, half-finished code, drafts of emails, medical questions, whatever, into on a daily basis had a window where that trust boundary cracked a little. That deserves more than a paragraph buried under the fourth GPT-4 demo video of the week.
I'm not saying stop using it. I'm still using it, obviously, I'm not made of principle. But I did go finally turn off chat history for a bit, which I'd been meaning to do anyway since I never actually go back and read old conversations, I just let them pile up like browser tabs. And it made me actually read the privacy settings menu for the first time, which I probably should've done back in December when I signed up.
Small tangent, but related in spirit: Twitter also announced this same week that they're going to start yanking the legacy blue checkmarks on April 1st unless people pay for Twitter Blue. I don't have much to say about that other than it's very funny that the "verification" system is becoming a subscription tier, and that a decent chunk of the outrage I've seen about it online is coming from accounts that, as far as I can tell, have never once needed to prove they're not an impersonator. Anyway. Not the main story, just noting it happened the same week for whoever's reading this in ten years trying to remember what March 2023 was like.
Back to the ChatGPT thing for a second, because I think the actual lesson here isn't "AI bad" or even "OpenAI bad," it's the much more boring and much more universal one: any tool that's growing this fast, onboarding this many users this quickly, is going to have infrastructure that's held together with more duct tape than anyone's marketing page will admit. That's true of basically every fast-growing product I've ever used, going back to services that don't even exist anymore. The pace of the growth outruns the pace of the hardening, every time, and the users are the ones who find out where the seams are.
If you're subscribed to Plus, it's worth going and turning off history retention even if you weren't affected, just so there's less sitting there to leak next time. There will be a next time. There always is.