Skip to main content
VerifiedExfiltration

A hiring chatbot's administrator console opened to a default password and let researchers read applicant chats

In June 2025 two researchers found that the McHire administrator interface, run by Paradox.ai, accepted a default username and password. Behind it an insecure direct object reference let them step through applicant identifiers and read chat records holding names, email addresses, phone numbers and network addresses. The credentials stopped working within about two hours of the report.

The verdict

Verified

The document exists. The ledger fetched it at its publisher and quotes it.

Key facts

What the sources say

Record ID
AIL-2026-0013
Kind
Exfiltration
Jurisdiction
United States
Last verified
Added
  • The researchers write that they entered the same six digit string as username and password and were immediately logged in.
  • Behind the login an insecure direct object reference in an internal interface let applicant records be enumerated by identifier.
  • Paradox.ai states the account had not been logged into since 2019 and should have been decommissioned.
  • Paradox.ai states the researchers viewed and downloaded seven chat records, five of which contained candidate information, and that nothing was published.
  • The default credentials stopped working the same evening as the report, and the vendor confirmed resolution the next day.

Dimension by dimension

6 dimensions, each one stated, silent or open

Identity, Authorization, Limits, Logging and audit, Revocation, Accountability. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

IdentitySilent
A shared default administrator credential with no second factor was the only identity in front of the applicant data.Ian Carroll and Sam Curry, McHire research writeup, primary source, 15 September 2026.
AuthorizationSilent
The direct object reference meant any authenticated session could read any applicant's record.Ian Carroll and Sam Curry, McHire research writeup, primary source, 15 September 2026.
LimitsSilent
No rate limit or record ceiling stopped sequential enumeration of applicant identifiers.Ian Carroll and Sam Curry, McHire research writeup, primary source, 15 September 2026.
Logging and auditStated
The vendor's records established that only the researchers reached the account and exactly how many chats were downloaded.Paradox.ai, responsible security update, primary source, 9 July 2025.
RevocationStated
The default credentials were disabled within about two hours of the report reaching the vendor.Paradox.ai, responsible security update, primary source, 9 July 2025.
AccountabilityStated
The vendor published a named statement owning the failure and opened a disclosure programme.Paradox.ai, responsible security update, primary source, 9 July 2025.

Figures

Every number, with who measured it and when

  1. 64,000,000 records

    Applicant chat records the researchers state were reachable

    Ian Carroll and Sam Curry, McHire research writeup, primary source, as of .

  2. 5 records

    Candidate records the vendor states were actually viewed

    Paradox.ai, responsible security update, primary source, as of .

What it changes

For a team deploying an agent

The agent here was ordinary; the failure was the console behind it. Identity is the missing control, and it is the cheapest one on the list: no default credentials, a second factor on any console that can read candidate data, and a scheduled sweep for accounts nobody has signed into in years. The two controls that held, logging and fast revocation, are why this stayed a near miss.

Sources

What this record was verified against

  1. Ian Carroll and Sam Curry, McHire research writeupPrimary · 15 September 2026
  2. Paradox.ai, responsible security updatePrimary · 9 July 2025
  3. Krebs on Security, Poor passwords tattle on AI hiring bot makerSecondary · 17 July 2025

Related

Records that sit beside this one

Cite this record

Free to reuse under CC BY 4.0, with attribution. The record ID AIL-2026-0013 is permanent and is never reused.

In a sentence
According to the GAGE Agent Incident Ledger (as of 15 September 2026), a hiring chatbot's administrator console opened to a default password and let researchers read applicant chats.
APA
GAGE (Global Academy of Generative-AI Education). (2026). A hiring chatbot's administrator console opened to a default password and let researchers read applicant chats. Agent Incident Ledger. Retrieved 15 September 2026, from https://www.gage.academy/tools/agent-incident-ledger/records/AIL-2026-0013-mchire-hiring-chatbot-default-password-applicant-records
MLA
"A hiring chatbot's administrator console opened to a default password and let researchers read applicant chats." Agent Incident Ledger, GAGE (Global Academy of Generative-AI Education), 15 September 2026, https://www.gage.academy/tools/agent-incident-ledger/records/AIL-2026-0013-mchire-hiring-chatbot-default-password-applicant-records.
Chicago
GAGE (Global Academy of Generative-AI Education). "A hiring chatbot's administrator console opened to a default password and let researchers read applicant chats." Agent Incident Ledger. Last modified 15 September 2026. https://www.gage.academy/tools/agent-incident-ledger/records/AIL-2026-0013-mchire-hiring-chatbot-default-password-applicant-records.
Permalink
https://www.gage.academy/tools/agent-incident-ledger/records/AIL-2026-0013-mchire-hiring-chatbot-default-password-applicant-records

Last updated . Every record re verified . The ledger is checked weekly, every Monday, and the same day for any vendor disclosure.

Back to the full ledger, or every record for United States and every exfiltration record.

GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.

Powered by GAGE, free EU AI Act tools from the Global Academy of Generative-AI Education
CallEmailHelp