McHire AI Chatbot Leak Exposed 64M Job Seekers

An AI hiring bot meant to screen fast-food applicants ended up handing over their personal data to anyone who tried the password “123456.” Security researchers Ian Carroll and Sam Curry disclosed that McHire — the McDonald’s recruitment platform built by AI vendor Paradox.ai and fronted by a chatbot named Olivia — exposed as many as 64 million job-application records through a pair of basic, well-understood security failures. The researchers reported the issues on June 30, 2026; the most severe hole was closed the same day, and both flaws were confirmed fixed by July 1.

How it happened

The breach did not require a sophisticated exploit. It required guessing.

Carroll began by probing McHire’s administrative login. He tried “admin” for both the username and password; when that failed, he tried “123456” — and it worked. The default credentials granted administrator access to a test McDonald’s franchise account on the platform, with no multi-factor authentication standing in the way. A production system handling the personal data of tens of millions of people was, in effect, protected by one of the most common passwords in existence.

Administrative access alone was serious. But the researchers then found a second, more consequential flaw: an insecure direct object reference, or IDOR. Once logged in, they noticed that each applicant’s record was tied to a sequential ID number visible in the browser’s address bar. By simply changing that number, they could pull up the complete application records and chatbot conversation logs of other, real applicants — people who had nothing to do with the test account they had accessed.

Because the IDs were sequential, the exposure was effectively unbounded. An attacker could iterate through the numbers one by one and systematically harvest the data of everyone who had ever applied through McHire. The researchers estimated the reachable set at roughly 64 million records.

What was exposed

The leaked records included applicants’ names, email addresses, phone numbers, and IP addresses, along with the chat logs from their interactions with Olivia, the AI interviewer. The researchers reported that Social Security numbers were not part of the exposed data.

That distinction matters for the severity assessment but does not neutralize the risk. A database of tens of millions of verified names, working email addresses, and phone numbers — all tied to people actively seeking employment — is a premium input for targeted phishing and social-engineering campaigns. Job seekers are a naturally receptive audience for messages that appear to come from a prospective employer, which makes this particular dataset unusually well-suited to fraud built on top of it. The chat transcripts add context an attacker could use to make a lure more convincing.

The fix and the response

The remediation was as fast as the vulnerability was old. After Carroll and Curry notified Paradox.ai and McDonald’s on June 30, the default credentials were revoked the same day, and both the authentication weakness and the IDOR flaw were confirmed resolved by July 1.

Paradox.ai said it has since introduced additional security measures, including revised password requirements, fixes to the API endpoints behind the IDOR issue, a new bug-bounty program to surface future vulnerabilities, and a dedicated security contact channel for researchers. There is no public indication that the flaws were exploited by malicious actors before the researchers found them — but by the nature of the IDOR bug, that cannot be proven either way.

The AI angle is real, but the flaws are old

It would be easy to file this under “AI risk,” and there is a genuine AI dimension: McHire is an agentic hiring product, an automated interviewer collecting sensitive information at scale from millions of people who assume a global brand will protect it. The more of the applicant funnel a company hands to an AI system, the larger and more centralized the honeypot of personal data becomes — and the higher the stakes when the plumbing around that system is weak.

But the flaws themselves have nothing to do with machine learning. A default password left in place and an IDOR that trusts a user-supplied ID are among the oldest, most documented weaknesses in web security. IDOR has appeared on the OWASP list of top application risks for years; “change the number in the URL” is a first-day penetration-testing technique. The lesson is not that AI is uniquely dangerous, but that wrapping a modern AI interface around a conventional web application does not exempt the underlying application from conventional security discipline.

That discipline is well established. Systems handling personal data should enforce proper authentication — no shared default credentials, and multi-factor authentication on administrative access as a baseline. Access to individual records should be checked against the identity of the requester, not granted on the basis of a guessable ID, which is the core principle behind a zero-trust posture. And endpoints that expose records by sequential identifier should be behind rate limiting and authorization checks that make bulk enumeration impossible. None of this is novel; all of it was missing.

What it means

The McHire exposure is a case study in how the least glamorous vulnerabilities remain the most dangerous — and in how the shift toward AI-mediated services concentrates risk.

Who’s exposed. Up to 64 million job applicants, whose contact details and application context now must be treated as potentially compromised, even though the flaws were fixed quickly and no malicious exploitation has been confirmed. The most realistic downstream threat is phishing aimed at people expecting to hear back about a job.

Who’s responsible. The failure sits primarily with the platform vendor, Paradox.ai, which shipped and operated a system with a default password and an IDOR flaw. But the incident is also a reminder that the brand on the front door owns the reputational risk: applicants trusted “McDonald’s,” not “Paradox.ai.” Enterprises deploying third-party AI systems inherit the security debt of those systems, and vendor due diligence has to extend to the boring fundamentals — credential handling, access control, endpoint authorization — not just model quality.

What to watch. Whether this incident accelerates scrutiny of the fast-growing category of AI hiring and screening tools, which collect sensitive personal data at enormous scale with relatively little regulatory oversight. As more of the recruiting pipeline is automated, the databases behind these bots become higher-value targets — and, as McHire shows, the barrier to reaching them can be as low as a six-digit password. The pattern echoes other 2026 incidents where the AI layer was sound but the surrounding software was not, from poisoned developer packages to agentic workflows abused through their own tooling. The interface changed; the fundamentals did not.