2026-09-20T23:22:28.549Z
- publishedAt:
Not provided→ 2025-07-11T00:00:00.000Z
SOURCE-LINKED INTELLIGENCE
McDonald's McHire AI Recruitment Platform Reportedly Exposed Data of 64 Million Applicants via Default Login and API Vulnerability
Researchers Ian Carroll and Sam Curry reported that McDonald's AI-powered hiring tool, McHire (using Paradox.ai's "Olivia" chatbot), could purportedly be accessed via default admin credentials and an insecure direct object reference in an internal API. The flaws allegedly allowed viewing of applicants' personally identifiable information and chat histories. McDonald's and Paradox reportedly patched the issues within a day of disclosure; Paradox stated only five records were accessed.
Read original source ↗ Open in workspace
- recordType
- incident-report
- evidenceStatus
- reported
- region
- Global
Reported occurrence date: 2025-06-30T00:00:00.000Z
Evidence & attribution
- AI Incident Database
- AI Incident Database · 2025-07-11T00:00:00.000Z
AI Incident Database, Responsible AI Collaborative; McGregor (2021), Preventing Repeated Real World AI Failures by Cataloging Incidents. Incident-specific contributor credits are available at each citation link. Metadata adapted; article text excluded.
License: CC BY-SA 4.0
First collected: 2026-09-19T22:50:59.123Z. This is not the publication date.
Observed changes
AIIC observation times, not verified publisher revision times. Up to eight recent revisions.