Job applicants
Incidents Harmed By
Incident 11792 Report
McDonald's McHire AI Recruitment Platform Reportedly Exposed Data of 64 Million Applicants via Default Login and API Vulnerability
2025-06-30
Researchers Ian Carroll and Sam Curry reported that McDonald's AI-powered hiring tool, McHire (using Paradox.ai's "Olivia" chatbot), could purportedly be accessed via default admin credentials and an insecure direct object reference in an internal API. The flaws allegedly allowed viewing of applicants' personally identifiable information and chat histories. McDonald's and Paradox reportedly patched the issues within a day of disclosure; Paradox stated only five records were accessed.
MoreIncident 15751 Report
Eightfold AI Hiring Tools Allegedly Secretly Scored Job Applicants for Employers
2026-01-20
Two California job applicants reportedly filed a proposed class action alleging that Eightfold AI's hiring platform secretly gathered personal data, generated candidate reports, and scored applicants for employers without required notice or dispute rights. The complaint says Eightfold's Evaluation Tools ranked applications submitted to companies including PayPal and Microsoft; both named plaintiffs alleged they were evaluated and rejected or not advanced.
More