Security brief
McHire disclosure shows why AI services still need basic access controls
Researchers reported weak administrative credentials and object-level access failures in the hiring platform.
What happened
Reporting on the July 2025 McHire disclosure describes two ordinary application-security failures around an AI hiring service: a weak default administrative login and an API authorization issue. Researchers Ian Carroll and Sam Curry demonstrated access to applicant information.
CSO reports that McDonald’s and Paradox.ai addressed the issues after disclosure. Potentially accessible records should not be described as proof that criminals downloaded every record, or that each record represents a different person.
The lesson for procurement is concrete: test administrative access, account lifecycle controls, and authorization on individual records. The presence of a chatbot does not replace those controls, and protecting the model alone would not resolve these application-layer weaknesses.
What we know
- Affected service
- McHire / Paradox.ai hiring platform
- Disclosure period
- June–July 2025
What remains unknown
- Open question
- The reporting reviewed does not establish criminal theft of every accessible record.
Source references
-
CSO