It looks like ChatGPT’s website accidentally exposed email addresses that belonged to random users.
The issue occurred on Monday morning when some users also spotted ChatGPT displaying conversation histories that were not their own. During that time, James Laidler tried to sign up for ChatGPT Plus, the paid version of the AI-powered chatbot. But he initially encountered errors.
However, at about 10:36 am CT, he finally reached the payment page for ChatGPT Plus after refreshing several times. The only problem? “I got a checkout page with an email address I didn’t recognize,” said Laidler, who also submitted screenshots as evidence.
He continued to refresh the site, hoping to see a normal checkout page. But Laidler either encountered an error or another payment form that already had someone else’s email address already filled inside. “I saw four (email addresses) in total before I stopped doing it anymore,” he said. “It was clearly other people’s contact information.”
Laidler wasn’t the only one who encountered the problem. On Reddit and Twitter, several other users have also reported seeing email addresses from strangers popping up in the ChatGPT Plus payment form on Monday morning.
“This is crazy, I'm seriously concerned now about the security of my account and my bank details,” wrote one user on Reddit, who decided to subscribe to ChatGPT Plus, despite seeing someone else’s email address initially populate the payment form.
ChatGPT’s developer OpenAI has only told PCMag it’s investigating the issues. So it’s unclear if the service merely experienced a glitch or something else. On the same day, ChatGPT also suffered a temporary outage. OpenAI has since suspended the chat histories sidebar and hit pause on letting users subscribe to ChatGPT Plus.
Laidler initially tried to subscribe to ChatGPT Plus because the paid version offers access to GPT-4, the upgraded large language model for the chatbot program. But now he’s decided to skip on ChatGPT Plus, citing the potential email exposure problem. “I’m definitely not going to do that. Clearly, they need to work on this security vulnerability,” he said.
Laidler gave us three screenshots, each containing a random email address. We’ve emailed all three for comment, but have yet to hear back from any of them.