OpenAI disclosed a security incident involving its third-party analytics provider, Mixpanel, which affected a subset of its API account users. The breach exposed limited user profile data tied to platform.openai.com, including: - Name (as provided in the API account) - Email address linked to the API account - Coarse location (city/state/country derived from browser data) - Operating system and browser used to access the API - Referring websites - Organization/User IDs associated with the API account. OpenAI emphasized that no core systems, chat data, API requests/usage details, passwords, credentials, API keys, payment information, or government IDs were compromised. The incident was isolated to Mixpanel’s systems, and OpenAI removed the provider as a precaution. While Apple may have been indirectly involved, no customer data was exposed. Notifications were sent to all subscribers, though only API account holders were at risk. The breach was described as low-consequence, with no evidence of malicious exploitation of the exposed data.