McDonald's McHire AI Recruitment Platform Reportedly Exposed Data of 64 Million Applicants via Default Login and API Vulnerability

Researchers Ian Carroll and Sam Curry reported that McDonald's AI-powered hiring tool, McHire (using Paradox.ai's "Olivia" chatbot), could purportedly be accessed via default admin credentials and an insecure direct object reference in an internal API. The flaws allegedly allowed viewing of applicants' personally identifiable information and chat histories. McDonald's and Paradox reportedly patched the issues within a day of disclosure; Paradox stated only five records were accessed.

What this means for youAt home: if you applied for a job through a chatbot hiring tool, your personal details and chat history may have been exposed, so watch for phishing. At work: ask vendors of AI tools whether they use default passwords and how they test their security. In government: this supports calls for security standards on AI hiring systems that hold personal data.