OpenAI said a Mixpanel breach exposed API user metadata—and urged customers to watch for phishing attacks.