McDonald’s AI Hiring Bot Exposed Millions of Applicants’ Data

Key Points

  • Security flaw in McDonald’s AI hiring bot exposed millions of applicants’ data
  • Flaw allowed hackers to access applicant data using the password “123456”
  • Security researchers Ian Carroll and Sam Curry discovered the flaw
  • Paradox.ai has confirmed the findings and instituted a bug bounty program
  • McDonald’s has mandated Paradox.ai to remediate the issue immediately

McDonald's Golden Arches in Halftone

The iconic McDonald’s golden arches logo is displayed as a bright yellow symbol against a pure black background. The logo appears to have a halftone or dotted texture effect applied to it, giving it a stylized, artistic quality. The bottom of the right arch extends down into a base, creating the distinctive ‘M’ shape that is universally recognized as the McDonald’s brand mark.

Security Flaw in McDonald’s AI Hiring Bot

A security flaw in McDonald’s AI hiring bot, Olivia, has exposed the personal information of millions of job applicants. The flaw, discovered by security researchers Ian Carroll and Sam Curry, allowed hackers to access applicant data, including names, email addresses, and phone numbers, using the password “123456”.

The security researchers found that the platform that runs the Olivia chatbot, built by artificial intelligence software firm Paradox.ai, suffered from basic security flaws. The flaws allowed hackers to access the records of every chat Olivia had ever had with McDonald’s applicants, including all the personal information they shared in those conversations.

Paradox.ai has confirmed the findings and noted that only a fraction of the records accessed contained personal information. The company has instituted a bug bounty program to better catch security vulnerabilities in the future.

McDonald’s has stated that it is disappointed by the unacceptable vulnerability from Paradox.ai and has mandated the company to remediate the issue immediately. McDonald’s takes its commitment to cyber security seriously and will continue to hold its third-party providers accountable to meeting its standards of data protection.

Source: wired.com