Security researchers found that an administrator account for McHire, McDonald’s AI-powered hiring platform built by Paradox.ai and its “Olivia” chatbot, was protected only by the default credentials “123456” for both username and password. Combined with an insecure direct object reference flaw in an internal API, this allowed access to the chat histories and personal data of tens of millions of job applicants, including names, email addresses, and phone numbers. Paradox.ai disputed the scale, saying only a handful of records were actually accessed by the researchers who disclosed the issue, though the underlying vulnerability affected a platform used by the large majority of McDonald’s franchises.