Can AI Leak Your Prompts to Other Users?
Cross-user AI leakage has happened before, through caching bugs and misconfigured logging, not the model itself. Here is what actually causes it and how to vet a tool.
Can AI Leak Your Prompts to Other Users?
Yes, it has happened, though rarely, and almost never the way people picture it. The most cited case is a real OpenAI bug from March 2023: a caching error in an open-source library let some ChatGPT users briefly see the conversation titles of other active users, and for a small slice of Plus subscribers, partial billing details. That was a software bug in a shared cache, not the model deciding to hand your prompt to a stranger. The more common, everyday risk with AI tools is different and less dramatic: your input being used to train future models unless you opt out, or a vendor's logging and analytics setup capturing more than it should. Both are worth understanding, and they call for different precautions.
What actually happened in March 2023
On March 20, 2023, OpenAI took ChatGPT offline after finding a bug in the redis-py client library used for its Redis cache. Under specific conditions, a canceled request could return a cached response meant for a different user, meaning one person's chat history sidebar could momentarily display another active user's conversation titles. OpenAI's own postmortem also confirmed the bug may have caused the unintentional visibility of payment-related information for about 1.2% of ChatGPT Plus subscribers who were active during a specific nine-hour window: first and last name, email, payment address, card type, and the last four digits of a card number. Full card numbers were never exposed. CNBC's coverage at the time has OpenAI's CEO confirming the same details. This is the incident people mean when they ask if AI can leak your prompts to other users, and it is a real, documented one, not a rumor.
The technical mechanisms that actually cause cross-user leakage
None of these require the AI model to do anything unusual. They are ordinary software and business problems sitting underneath an AI product.
Multi-tenant caching bugs. The March 2023 incident is the textbook case. Shared infrastructure, a cache, a queue, a connection pool, serves many users at once, and a bug in how requests are keyed or canceled can return the wrong user's cached data. The same class of bug can recur in any AI product built on shared backend infrastructure.
Training on your inputs by default. A different failure mode, but the one people most often mean by ai data privacy concerns. Consumer ChatGPT accounts default to letting conversations improve OpenAI's models unless you turn the setting off. Your exact prompt appearing verbatim in someone else's chat is not how this works; the realistic risk is a human reviewer reading a flagged conversation, a narrower threat than casual cross-user exposure.
Misconfigured logging and analytics. Session-replay tools, error trackers, and debug logs are common causes of accidental exposure across most software, and AI chat interfaces are not exempt. A pipeline that captures full request bodies, prompts included, and ships them to a dashboard with weak access controls is a leak waiting to happen, an operational risk on the vendor's side, not a property of the model.
Third-party plugins, connectors, and browser extensions. Once an AI tool can browse the web, call a plugin, or hand data to a connected app, your prompt can leave the primary vendor's privacy boundary and land under a different, often less rigorous, policy. A rogue browser extension that injects itself into an AI chat page is a documented way for conversation content to be scraped outside any provider's control.
What actually causes leakage versus what people worry about
What actually causes leakage | What people worry about but usually isn't the risk |
|---|---|
Shared-cache or session bugs (the 2023 Redis incident) | "The model will recite my exact prompt back to a stranger" |
Misconfigured logging, analytics, or debug dashboards | "Talking about my business tips off a competitor using the same app" |
Third-party plugins or browser extensions with their own data handling | "Voice or video chat is uniquely more exposed than text" |
Vendor default training on consumer-tier inputs without opt-out | "Any employee at the AI company can casually browse my chats" |
Does training on your data count as leaking it?
Two questions get merged that should not be. One is whether does chatgpt share your prompts with a specific other person, which is what the March 2023 bug did, and is rare because it requires an actual infrastructure defect. The other is whether the provider trains on your data at all, routine by design on free and consumer plans unless you opt out. For business use, OpenAI states that ChatGPT Team, ChatGPT Enterprise, and the API do not train on inputs or outputs by default. Other major providers publish similar enterprise-tier distinctions. On ai prompt leakage, the takeaway is that the free consumer product and the business tier sold under a contract are not the same privacy product, even with an identical interface.
A checklist before pasting sensitive information into an AI tool
Find the data-use or training opt-out setting. No visible control means the default answer is usually yes.
Check for an enterprise or API tier with different terms. A vendor separating a free product from a paid tier with a no-training default is telling you which version is built for sensitive use.
Ask for a SOC 2 report. A SOC 2 Type II report is an independent audit of a vendor's security controls, not a marketing claim. Its absence at a vendor handling sensitive prompts is informative.
Look for a written no-retention or short-retention policy. "We care about your privacy" is not a policy. A stated retention window is.
Check which plugins or connectors are enabled. Each connected tool is its own privacy boundary, so confirm its policy rather than assuming the main product's terms cover it.
None of this means avoiding AI tools for anything sensitive. It means matching the tier and the tool to what you are pasting in, the judgment you would apply to any third-party software vendor. For what happens after you hit send, see what happens to your prompts after you send them to an AI; for the same checklist applied to customer records, see is it safe to share customer data with ChatGPT; and if you are evaluating a vendor for a contract, whether an AI product needs SOC 2 to sell into businesses covers what that audit verifies. Small businesses weighing which tools are worth adopting can start with our look at what actually works for small businesses using AI, and the broader practical guide to AI risks for builders covers this alongside the other risks worth weighing at once.
Frequently asked questions
Has ChatGPT actually leaked user data before?
Yes. On March 20, 2023, a bug in the redis-py library let some users see other active users' chat titles, and briefly exposed partial payment details for roughly 1.2% of ChatGPT Plus subscribers active in a nine-hour window. OpenAI confirmed the details publicly and fixed the underlying library.
Does asking ChatGPT a question train it on my data?
On a free or Plus consumer account, yes, by default, unless you disable model training in data controls. On ChatGPT Team, Enterprise, or the API, OpenAI states inputs are not used for training by default.
Is one AI chatbot safer than another for sensitive prompts?
Safety depends less on the company and more on the tier. Compare the specific tier you plan to use against the checklist above rather than assuming one brand is categorically safer.
Can an AI chatbot show my conversation to another customer of the same company?
It can, but only through a bug like the 2023 caching incident, not as a designed feature. A company's AI assistant built on shared infrastructure without proper session isolation can reproduce the same class of bug, which is why session handling is a fair question for any vendor building on AI.
What's the safest way to use AI with confidential business information?
Use a business or API tier with a stated no-training default, confirm a SOC 2 report exists, disable plugins you don't need, and avoid pasting anything you would not put in a vendor contract you haven't read.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
