Loading story…
OpenAI confirmed a global outage that prevented many users from logging into ChatGPT, creating new accounts, loading current or previous conversations, and sending messages. The disruption began around 8 p.m. EDT and affected users in multiple regions, including the United States and Europe, with OpenAI acknowledging the incident on its status page and saying it had identified login-related issues and was working on mitigation.
Reports said the outage lasted about an hour for many users, though OpenAI initially indicated the incident was still ongoing as engineers responded. The disruption also reportedly affected OpenAI's Codex platform and parts of the OpenAI API, while other reporting said the impact appeared largely limited to the consumer-facing ChatGPT service rather than a broader API failure that would have caused wider downstream business disruption.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Security Magazine reported that the August 19, 2026 ChatGPT outage lasted about one hour. The article characterized the impact as affecting the consumer-facing ChatGPT application while stating the API remained available.
OpenAI posted the incident on its status page and said it had identified login issues across affected services and was working on a mitigation. As of 8:15 PM ET, the incident was still ongoing and marked as identified.
Around 8 PM ET on August 19, 2026, ChatGPT suffered a global outage that prevented some users from signing in, creating accounts, loading current or previous chats, and sending messages. Reports said the disruption affected users in multiple regions, including the United States and Europe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenAI said a technical error caused some verified cybersecurity researchers to lose access to its **Trusted Access for Cyber (TAC)** program, which provides limited access to cyber-focused capabilities in ChatGPT. Affected users reported seeing messages that their identity could not be verified or that their accounts were ineligible when attempting to use ChatGPT’s Cyber page, and OpenAI described the issue as affecting a limited number of participants. Researchers told TechCrunch that the access loss disrupted legitimate security work, and OpenAI reportedly instructed impacted users by email to reapply and complete verification again. Reporting also noted that the interviewed affected researchers were all based outside the United States and Europe, raising questions about whether the incident disproportionately impacted users in other regions amid broader criticism that AI providers’ access controls can impede bona fide cyber research.
Aug 20, 2026
OpenAI has implemented significant changes to its data retention policies for ChatGPT users following a legal dispute with major news organizations, including The New York Times. The lawsuit alleged that users were leveraging ChatGPT to bypass paywalls, often by using temporary or deleted chat logs, prompting a court order that required OpenAI to preserve these logs indefinitely. OpenAI initially resisted the order, citing user privacy concerns, but ultimately lost the legal battle. By July, news plaintiffs began reviewing the preserved logs, which contained only ChatGPT's outputs, while attempts by some users to intervene in the case were denied due to their status as non-parties. On September 26, OpenAI was permitted to cease the controversial practice of retaining all output log data that would otherwise be deleted, following a joint motion approved by US Magistrate Judge Ona Wang. However, some users' deleted and temporary chats remain subject to monitoring under the agreement. This development marks a shift in OpenAI's approach to user data privacy and legal compliance, as the company balances regulatory demands with user expectations. Concurrently, OpenAI has experienced a dramatic increase in AI bot traffic, particularly after the release of its GPT-5 model on August 5, 2025. According to Akamai, OpenAI's bots—including ChatGPT-User, GPTBot, and OAI-SearchBot—now account for the majority of AI bot traffic across major web applications and APIs, with overall traffic rising nearly 300% year-to-date. The release of GPT-5 led to a surge in activity: OAI-SearchBot traffic increased by 136%, ChatGPT-User by 65%, and GPTBot by 66% during August and September. These changes in bot behavior are attributed both to increased adoption of the improved GPT-5 model and to modifications in how the bots interact with external sources. The period following the legal settlement and the GPT-5 launch has been characterized by unusual and intensified bot activity, impacting organizations that rely on web and API security. OpenAI's evolving platform and policy landscape underscore the complex interplay between technological advancement, user privacy, and legal oversight. Organizations are advised to monitor these developments closely, as changes in OpenAI's data handling and bot operations may have direct implications for data privacy, compliance, and web infrastructure security. The ongoing adjustments to OpenAI's practices reflect broader industry trends in AI governance and the challenges of managing large-scale AI deployments in a rapidly changing regulatory environment. Security teams should remain vigilant for further changes in bot behavior and data retention practices as OpenAI continues to adapt to legal and market pressures. The intersection of legal action, user privacy, and technical innovation at OpenAI provides a case study in the evolving risks and responsibilities associated with AI-driven platforms.
Jun 29, 2026
OpenAI patched a ChatGPT vulnerability that allowed sensitive conversation data and uploaded files to be exfiltrated through a covert DNS-based outbound channel in the platform's code-execution runtime. Check Point Research said a malicious prompt or backdoored custom GPT could abuse the isolated Python/Linux environment to leak user content without approval dialogs or visible warnings, and the same path could support bidirectional communication for remote shell access and command execution. OpenAI said it had already identified the underlying issue internally and fully deployed a fix on **February 20, 2026**; reports said there is no evidence of malicious exploitation. A separate OpenAI flaw in **Codex** also drew scrutiny after BeyondTrust Phantom Labs disclosed a critical command injection issue tied to GitHub branch names. The bug could let attackers inject commands, steal GitHub tokens, and potentially move laterally across shared repositories before OpenAI patched it on **February 5, 2026**. The disclosures underscore how AI assistants and coding agents can introduce new enterprise attack paths when outbound communications, runtime isolation, and input validation are not tightly controlled.
Jun 29, 2026