Poor Passwords Tattle on AI Hiring Bot Maker Paradox.ai

Security researchers found that a weakly protected Paradox.ai test account (password "123456") allowed access to McDonald’s applicant chatbot data, and separate evidence shows a Paradox developer in Vietnam was infected with Nexus Stealer, which exfiltrated hundreds of passwords and authentication cookies — including credentials to SSO and Atlassian accounts — potentially exposing multiple customer environments and millions of applicant records. Paradox asserts limited exposure and that some passwords were stale, but stolen tokens and reused weak passwords indicate significant operational security failures and active credential compromise.