McDonald's AI hiring bot exposed 64 million applicants' data via weak credentials
Security researchers discovered that McDonald's AI-powered hiring chatbot platform, built by Paradox.ai, exposed personal data of approximately 64 million job applicants due to basic security flaws, including a backend account protected only by the password "123456". The vulnerability allowed unauthorized access to applicants' names, email addresses, phone numbers, and chat histories with the Olivia chatbot.
What happened
Security researchers Ian Carroll and Sam Curry discovered multiple basic web-based vulnerabilities in the McHire.com platform, which hosts Paradox.ai's Olivia chatbot used by McDonald's franchisees to handle job applications. They found that a backend administrator account was protected only by the password '123456', allowing them to access databases containing records of chats between applicants and the Olivia chatbot going back years.
The exposed data included approximately 64 million records with applicants' names, email addresses, and phone numbers. Paradox.ai confirmed the findings and noted that only a fraction of the records accessed contained personal information, stating the administrator account with the weak password had not been accessed by any third party other than the researchers.
Reported impact
The vulnerability exposed personal information of millions of McDonald's job applicants to potential unauthorized access. The weak security allowed any hacker to retrieve applicants' contact details and chat histories containing résumés and personal information they had shared during the application process.
Index analysis
The security flaw represented an absurdly basic vulnerability—using an easily guessable password to protect access to sensitive applicant data. Carroll noted the discovery came from investigating the 'uniquely dystopian' nature of using an AI chatbot for hiring screening.
Governance controls
Following disclosure, Paradox.ai stated it was implementing a bug bounty program to better catch security vulnerabilities in the future.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.