Lessons Learned From McDonald's Big AI Flub

McDonald's McHire hiring platform, which uses Paradox.ai's chatbot Olivia, exposed applicant data after default admin credentials and an IDOR on an internal API allowed researchers to retrieve chat records and some personal information; researchers reported the issue on June 30, McDonald's changed credentials within hours, and Paradox.ai says the issues were fixed and disputes the 64 million applicants figure. The incident highlights fundamental security failures (default passwords, lack of MFA, broken access control) and the need for stronger security and vendor/A I controls.