Jul 9, 2025Confirmed
McDonald's McHire AI hiring bot exposes up to 64 million applicants behind the password '123456'
AI loose in the worldData exfiltrationDERIVED
Approved by person, Oct 11, 2026. How entries are approved
Security researchers Ian Carroll and Sam Curry found that the admin panel behind Olivia, the Paradox.ai chatbot that screens McDonald's job applicants, accepted the test credentials 123456/123456 with no MFA. Combined with an IDOR flaw in the chat API, the account gave access to as many as 64 million applicants' chat records — names, emails, phone numbers. Paradox.ai confirmed the test account dated to 2019 and patched the flaws after disclosure.
What this means for youIf you applied for a job through an AI chatbot, your name, email, and phone number may have been exposed. Companies that use vendor AI hiring tools should ask about login protections and access controls. Regulators should require security audits for AI systems that handle personal data.
Sources
- WIREDhttps://www.wired.com/story/mcdonalds-ai-hiring-chat-bot-paradoxai
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Source data license: CC BY 4.0. Attribution to sipi.bot is required.
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2364. It has not been edited since it was approved; the hash above would not match if it had. How to verify