麦当劳AI工具惊现重大漏洞：“123456”当账号密码 30分钟6400万求职者数据“变透明”

Core Insights - The use of AI in recruitment, specifically through McDonald's McHire platform, has raised significant security concerns due to a major vulnerability that exposed sensitive applicant data [2][3][5] - The vulnerability allowed unauthorized access to approximately 64 million recruitment records, including personal information such as names, emails, and phone numbers [3][4] Group 1: Security Vulnerability - The McHire platform, utilizing the AI chatbot "Olivia" developed by Paradox.ai, had a critical security flaw that allowed easy access using default login credentials [3][5] - Independent security researchers discovered that the system could be breached in just 30 minutes using simple usernames and passwords, highlighting a lack of basic security measures [3][5] - The exposed data included personal information and chat histories, although it did not contain financial data or social security numbers [4] Group 2: Response and Accountability - Following the discovery of the vulnerability, both Paradox.ai and McDonald's confirmed the issue and took immediate action to rectify it, with Paradox.ai stating that all problems were resolved by July 1, 2025 [5][8] - McDonald's expressed disappointment in Paradox.ai for the security lapse, emphasizing the need for robust data protection measures [5][8] - Paradox.ai initiated a bug bounty program to identify future security weaknesses, indicating a commitment to improving their security protocols [5][8] Group 3: Industry Implications - The incident serves as a warning to companies about the risks of deploying AI workflows without adequate oversight, potentially exposing millions of users to unnecessary risks [8] - Experts stress that the issue lies not with AI technology itself but with the lack of fundamental security protections and governance mechanisms [8] - There is a call for AI systems that handle personal data to adhere to the same privacy protection and security standards as core business systems [8]