In the wild
Realized harm
ChatGPT user shown unrelated third parties' conversations containing credentials, traced by OpenAI to a compromised account resold for pooled access
AIR-2024-0002 AIR record · 2024-01-openai-chatgpt-account-takeover-conversation-exposure
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
OpenAI officials say that the ChatGPT histories a user reported result from his ChatGPT account being compromised. The unauthorized logins came from Sri Lanka, an Open AI representative said.arstechnica.com
The record
Disclosed
2024-01-30
Occurred
2024-01
Vendor
OpenAI
Product
ChatGPT
Risk domain
Privacy › Sensitive data exposure
Also touches
Data exfiltration channels
System type
Generative model
Who acted
AI was the target (contested) — a compromised account and session handling exposed other users' conversations
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Credential compromise
Impact type
Information disclosure, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
conversations belonging to at least one pharmacy-portal support user, including login credentials, exposed to an unrelated party
Capability abused
Defense & remediation
Recorded defense
password authentication; no MFA enforced at the time
Guardrail kinds
Authentication
Guardrail outcome
Silent
Fix shipped
OpenAI account security hardening; MFA later offered
Taxonomy & references
Curator notes
OpenAI disputed the 'cross-tenant leak' framing and attributed it to account takeover feeding a pool of identities resold for free access. Either reading is an in-the-wild harm: real credentials pasted into a chatbot reached an unauthorised third party. Conversation history is a durable, high-value secret store — the reason memory_store is a surface in this corpus. AI Incident Database incident 657.
Supporting sources
Cite as
Enkrypt AI. "ChatGPT user shown unrelated third parties' conversations containing credentials, traced by OpenAI to a compromised account resold for pooled access". AIR, AIR-2024-0002. https://agentincident.vercel.app/i/AIR-2024-0002/ (accessed 2026-10-19).