McDonald’s AI bot spills data on job applicants

Researchers found that McDonald’s McHire hiring chatbot and backend accepted default credentials (e.g., 123456:123456) and exposed an API that allowed access to virtually every application submitted to McDonald’s over years—potentially impacting up to tens of millions of applicants; Paradox.ai/McDonald’s patched the vulnerability after disclosure and there are no indications of prior criminal exploitation.