{
 "public_id": "AIR-2025-0056",
 "incident_id": "2025-07-mcdonalds-mchire-paradox-exposure",
 "date_disclosed": "2025-07-11",
 "date_occurred": "2025-06-30",
 "title": "McDonald's McHire AI hiring chatbot exposed 64 million job applications via a 123456 test account and an IDOR",
 "class": "responsible_disclosure",
 "attack_surface": "consumer_chatbot",
 "initial_vector": "default_test_credentials_plus_insecure_direct_object_reference",
 "agent_capability_abused": [
  "applicant_conversation_store",
  "candidate_auth_tokens"
 ],
 "target_product": "McHire (Paradox.ai Olivia hiring chatbot)",
 "target_vendor": "Paradox.ai / McDonald's",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "data_exposure"
 ],
 "blast_radius": "64 million job applications - names, addresses, phone numbers, email addresses, candidacy state and consumer-UI auth tokens",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "default_credentials",
   "idor",
   "hiring_agent",
   "pii_at_scale"
  ]
 },
 "defense_present": "none effective - the 2019 test account password was never rotated",
 "defense_bypassed": true,
 "fix_shipped": "both flaws confirmed resolved 2025-07-01",
 "primary_sources": [
  "https://www.securityweek.com/mcdonalds-chatbot-recruitment-platform-leaked-64-million-job-applications/"
 ],
 "verified_quote": "name, address, phone number, email address, candidacy state, and an auth token to log into the consumer UI",
 "confidence": "high",
 "notes": "Found by researchers Ian Carroll and Sam Curry; reported 2025-06-30, fixed 2025-07-01, published 2025-07-11 (Wired had the original story). impact_realized false: Paradox.ai says only five applicants' chat interactions were accessed and no candidate information was shared online. Included because the harm channel is an AI agent holding conversational PII at scale and the coverage was journalism-led rather than CVE-led.",
 "risk_category": "privacy",
 "risk_secondary": [
  "product_misuse"
 ],
 "risk_subcategory": "PII Leakage",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": false,
 "agency_reason": "default credentials plus an IDOR exposed 64M applications",
 "vector_family": "other",
 "vector_detail": "default_test_credentials_plus_insecure_direct_object_reference",
 "guardrail_kind": [
  "none"
 ],
 "guardrail_outcome": "not_applicable",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI02",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "sensitive_data_exposure",
 "eai_domain": "privacy",
 "eai_secondary": [],
 "eai_reason": "subcategory: PII Leakage",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}