What happened
It was reported that in June 2025, two security researchers discovered that McDonald’s AI recruitment platform, McHire, had a serious security weakness that potentially exposed the personal information of millions of job applicants.
The platform, developed by Paradox.ai, used an AI chatbot called Olivia to interview applicants, collect their personal details and help franchisees manage recruitment. When the researchers examined the system, they discovered an old administrator account protected by the username and password “123456”, with no additional authentication required.
Once inside, they found another weakness that allowed applicant records to be accessed simply by changing a number in the request, potentially exposing names, contact information, chatbot conversations and other recruitment details.
The records were numbered up to approximately 64 million, although this represented the potential scale of exposure rather than 64 million confirmed complete applicant profiles. Paradox maintained that most records contained limited information and that only a small number of the records examined by researchers included detailed personal data.
The researchers notified McDonald’s and Paradox on 30 June 2025, and the companies moved quickly to disable the account and close the security weakness by the following day. There was no evidence that criminals had previously accessed the information, although the incident raised questions about how long the vulnerability had existed and whether earlier access could be ruled out.
What an auditable version would have shown
The most troubling aspect of the incident was not simply that an old account still used an easily guessed password, but that the weakness provided a route into a system containing an enormous amount of personal information.
An auditable system would have recorded who accessed applicant records, which information they requested and whether unusual patterns of activity suggested someone was collecting data they were not authorised to see.
Those records could have helped investigators establish whether anyone had exploited the vulnerability before the researchers discovered it, rather than relying primarily on the absence of evidence of earlier misuse.
Where the gap was
Headlights identifies authority ambiguity and a rules-behaviour gap, where a system allows access to information without properly establishing whether the person requesting it has permission to see it.
The administrator account had apparently remained accessible for years, while the weakness in the applicant records meant that gaining access to one part of the system could expose information belonging to many other people.
There is a familiar human behaviour behind this kind of failure, where temporary shortcuts become permanent because they continue to work and nobody returns to question whether they are still appropriate.
An old test account might appear harmless when it is created, but when systems grow and begin handling millions of personal records, those forgotten decisions can become serious security risks.
What governance should have looked like
A recruitment platform handling personal information at this scale needs security controls that are regularly tested, particularly around administrator accounts and access to individual applicant records.
An EgressGate could restrict the release of sensitive information to properly authorised users, while a ConductRecord could preserve evidence of who accessed which records and whether suspicious activity was detected.
Old accounts should also be removed when they are no longer needed, with strong authentication and access restrictions applied to any account capable of viewing personal information.
The wider lesson is that adding AI to a business process does not remove the need for basic security, and a sophisticated recruitment chatbot offers little protection if the information behind it can be reached through a password as simple as “123456”.
Failure Pattern: McDonald’s AI recruitment platform contained an old administrator account with weak credentials and an access-control vulnerability that potentially exposed records associated with approximately 64 million applicants.
Governance Principle: Organisations collecting personal information through AI systems must enforce strong authentication, restrict access to individual records and maintain reliable evidence of how sensitive information is accessed.
The reference implementation of EgressGate and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- McDonald’s AI hiring tool’s password ‘123456’ exposed data of 64M applicants (CSO Online)
- McDonald’s AI hiring bot exposed 64 million applicants’ details (Computing)
- Security flaw in McDonald’s AI recruitment system exposes data of millions (INCIBE-CERT)