McDonald's McHire AI hiring bot exposes up to 64 million applicants behind the password '123456'
McDonald's / Paradox.ai (McHire) · Jul 9, 2025 · Customer service agent
What happened
Security researchers Ian Carroll and Sam Curry found that the admin panel behind Olivia, the Paradox.ai chatbot that screens McDonald's job applicants, accepted the test credentials 123456/123456 with no MFA. Combined with an IDOR flaw in the chat API, the account gave access to as many as 64 million applicants' chat records — names, emails, phone numbers. Paradox.ai confirmed the test account dated to 2019 and patched the flaws after disclosure.
Causal vector
A default-credential admin account plus an incrementable applicant-ID (IDOR) exposed the chatbot's entire conversation store
Source
Reported by WIRED. Verified against the primary report.
The agent was fine; the credentials around it were not. The same lesson applies to spend: an agent's key is only as strong as the weakest account that can act as it, so per-key velocity limits and anomaly flags on bulk reads are the control that survives a leaked password.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
15 malicious JetBrains plugins silently exfiltrated developers' OpenAI, DeepSeek and SiliconFlow API keys
JetBrains Marketplace (third-party plugin authors) · Jun 10, 2026
Compromised LiteLLM PyPI packages harvest credentials via supply-chain attack
LiteLLM (BerriAI) · Mar 24, 2026
Step Finance treasury drained in $27–40M exploit
Step Finance · Jan 31, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.