Become a Member

Regulation TrackerLaws, orders and treaties read for their security duties and clocks Standards & FrameworksAttack taxonomies, control catalogues and frontier frameworks AI Incident DatabaseThe security incident record, with mechanism and lesson Research Paper LibraryThe papers that define the field, summarised OSS DirectoryRed teaming, guardrail, supply chain and evaluation tools Case StudiesProgrammes built, with measured outcomes AI Vulnerability TrackerCVEs and advisories for the components AI systems are built from

Latest in the tracker

New York Stop Addictive Feeds Exploitation (SAFE) for Kids Act and implementing rulesNew York's law restricting algorithmic feeds for minors takes effect on 25 January 2027 under final rules published in July 2026, with certified age assurance and $5,000-per-violation penalties.

Knowledge Base Regulation Tracker Standards & Frameworks OSS Directory AI Incident Database Research Paper Library Case Studies Society Articles News Jobs About Charter Become a Member

Home/AI Incident Database/McDonald's McHire AI Recruitment Platform Reportedly Exposed Data of 64 Million Applicants via Default Login and API Vulnerability

McDonald's McHire AI Recruitment Platform Reportedly Exposed Data of 64 Million Applicants via Default Login and API Vulnerability

Researchers Ian Carroll and Sam Curry reported that McDonald's AI-powered hiring tool, McHire (using Paradox.ai's "Olivia" chatbot), could purportedly be accessed via default admin credentials and an insecure direct object reference in an internal API. The flaws allegedly allowed viewing of applicants' personally identifiable information and chat histories. McDonald's and Paradox reportedly patched the issues within a day of disclosure; Paradox stated only five records were accessed.

Severity: MediumParadox.Ai'S Olivia ChatbotMchireEnterprise Ai SystemsCompromise of privacy by obtaining

Sources

incidentdatabase.aihttps://incidentdatabase.ai/cite/1179/

Incident summary from the AI Incident Database, used under CC BY-SA 4.0.

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Submit incident Report a correction or request removal

McDonald's McHire AI Recruitment Platform Reportedly Exposed Data of 64 Million Applicants via Default Login and API Vulnerability

Sources

Contribute

Related in AI Incident Database

Motive AI dashcams allegedly collect truckers' biometric data and build licence-plate location records without consent

A Chinese Tech Worker at Zhihu Fired Allegedly via a Resignation Risk Prediction Algorithm

Xsolla Employees Fired by CEO Allegedly via Big Data Analytics of Work Activities