OpenAI has confirmed that a security breach at Mixpanel, one of its external analytics providers, resulted in the exposure of limited profile information belonging to some users of its API services.

The incident occurred on November ninth when Mixpanel detected that an attacker had accessed its systems and exported data tied to OpenAI’s API analytics dashboard.

According to OpenAI, the compromised information included user names, email addresses, approximate geographic location, browser and operating-system details, referral information and internal account identifiers.

No chat content, payment data, API keys, passwords, or any sensitive authentication credentials were exposed, and regular ChatGPT users were not affected.

Upon confirmation of the breach, OpenAI immediately removed Mixpanel from its production environment, halted all data sharing with the service, and began notifying the affected API customers directly.

The company has also committed to tightening its vendor-security requirements and reviewing all third-party integrations.

While the leaked information is considered low-sensitivity, cybersecurity specialists warn that it could still enable targeted phishing or social-engineering campaigns.

OpenAI has advised API users to be alert for suspicious communications but stated that password resets are unnecessary, since no access credentials were stolen.

The incident highlights the broader risks that arise when major technology companies rely on external analytics providers.

As OpenAI continues its investigation, the company says it will strengthen oversight of its supply-chain partners and refine its internal data-sharing policies to prevent similar vulnerabilities in the future.