Description: Researchers Ian Carroll and Sam Curry reported that McDonald's AI-powered hiring tool, McHire (using Paradox.ai's "Olivia" chatbot), could purportedly be accessed via default admin credentials and an insecure direct object reference in an internal API. The flaws allegedly allowed viewing of applicants' personally identifiable information and chat histories. McDonald's and Paradox reportedly patched the issues within a day of disclosure; Paradox stated only five records were accessed.
Editor Notes: The following URL leads to the Reddit thread that ultimately led to the reported discovery: https://www.reddit.com/r/mildlyinfuriating/comments/1lo9s75/mcdonalds_hiring_ai_is_making_me_go_insane/.
Entities
View all entitiesAlleged: McDonald's , Paradox.ai , McHire and Paradox.ai's Olivia chatbot developed and deployed an AI system, which harmed McDonald's applicants.
Alleged implicated AI systems: McHire and Paradox.ai's Olivia chatbot
Incident Stats
Incident ID
1179
Report Count
2
Incident Date
2025-06-30
Editors
Daniel Atherton
Incident Reports
Reports Timeline
Loading...
A security oversight in McDonald's AI-powered hiring platform "McHire" was found exposing sensitive applicant data belonging to as many as 64 million job seekers.
Discovered in late June 2025 by security researchers Ian Carroll and Sam Curr…
Loading...
McDonald's is facing strong backlash after a shocking security lapse exposed sensitive data of nearly 64 million job applicants. The leak occurred because of a default admin password: "123456".
McDonald's is facing strong backlash after a s…
Variants
A "variant" is an AI incident similar to a known case—it has the same causes, harms, and AI system. Instead of listing it separately, we group it under the first reported incident. Unlike other incidents, variants do not need to have been reported outside the AIID. Learn more from the research paper.
Seen something similar?
Similar Incidents
Did our AI mess up? Flag the unrelated incidents
Similar Incidents
Did our AI mess up? Flag the unrelated incidents