Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
OpenAI reported a redis-py defect that let some active users see another user’s chat title and possibly limited payment information. This is a confirmed service incident, not evidence of an external intrusion.
ASSESSED SYSTEM
ChatGPT consumer service response-cache boundary during the March 20, 2023 incident, before the redis-py fix.
OUT OF SCOPE
No finding about training data, all payment card numbers, external intrusion, or other ChatGPT security controls.
Architecture: Standalone LLM / Generative AI (decision tree Q3) — Q2 NO: no autonomous agent tool chain is evidenced; Q3: direct model or inference service path is assessed. Tier 2: Tier 2 representative deployment scenario, bounded to the assessed system; the report does not establish every operator tier.
Documented attack or failure path
- The affected client requested ChatGPT history or subscription information.
- A redis-py caching fault returned limited information associated with another user.
- OpenAI disabled ChatGPT during investigation, fixed the defect, and notified affected subscribers.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The provider identified and repaired the redis-py cause after the incident; remediation is not credited to the pre-fix score.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.88 (midpoint 0.44), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.00w 0.12 | The observed pre-fix path enforced no effective per-user output scope at the response-cache boundary; this directly supports the 0.00 scope anchor. | The provider confirmed cached responses crossed user boundaries and disclosed another user’s chat title or limited payment information.source: primary report |
Unknown, not N/A: 25 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.25 | Request and response handling, without autonomous external actions in this representative service path. |
| AsAttack Surface Exposure | 0.75w 0.35 | A representative networked consumer AI service accepts requests from distinct users; this is a deployment assumption, not a measured exposure census. |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph or DGC is published, so Cp takes the framework worst-case default.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.25w 0.20 | The provider identified a specific redis-py defect and applied a dependency repair; .25 is an inferred repair-feasibility scenario, not an observed recovery-time test. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | Minimal public provenance: the original report identifies the affected path and event, but no operator assessment pack, signed configuration inventory, or repeated metric battery is published. |
| Ec — Public evaluation coverage | 0.02 | coverage 0.04 (1 of 26 applicable sub-metrics) × independence 0.60 × fidelity 1.00. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2023-03-24; age 1304 days on the workpaper reference date. Components: T_calendar 0.00 · C_event 0.35 · C_monitor 0.60. Binding term: T_calendar. Evidence reference is 2026-10-18, 1304 days after the earliest substantive public evidence (2023-03-24). C_monitor = 0.60 applies the Table 44 conservative default for Tier 2 because usable public monitoring-coverage evidence is unavailable; it does not assert that the deployment had no telemetry. C_event = 0.35: OpenAI confirmed cross-user cached-response disclosure during the March 20 service incident, a material user-boundary failure. No targeted post-event re-attestation is published for the bounded pre-fix assessment. No generic C_evidence cap is assigned from missing public inputs alone. These caps describe public-evidence confidence and do not change the normalized-assurance indicative ERS or assert an unreported operational control failure. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.01 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
3.3 midpoint, interval 0.9–5.8; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS · 1 record
CVE-2023-28858 CVSS 3.1 Base 3.7 Low
| Published score | 3.7 |
|---|---|
| CVSS version | 3.1 |
| Metric group | Base |
| Severity | Low |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| Scored by | NVD |
| Source record | https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-28858 (accessed 2026-10-18) |
| Affected component | redis-py request handling in ChatGPT |
| Scope note | The CVE describes the redis-py defect cited by OpenAI for this exact cross-user cache incident. |
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
WHAT THIS CASE TEACHES
The only observed rubric failure is cross-user cache scope; the remaining applicable sub-metrics are unknown.
Sources: Original primary report — ChatGPT redis-py cross-user response disclosure (2023-03-24)