Paradox (Olivia)
Nothing else moves frontline hiring volume like Olivia — but this is the vendor that left a live admin account on the password 123456, so audit the company, not just the product.
Element scores
Strengths
Olivia is the most proven conversational hiring agent in frontline and franchise recruiting, and the customer list is the evidence: McDonald's, Chipotle, 7-Eleven, CVS Health, Compass Group, Wendy's, Dell. It runs the whole funnel — job search, screening, scheduling, offers, onboarding, hiring events — over the channels candidates already use, in 100+ languages, 24/7, and it plugs into Workday, iCIMS, SAP SuccessFactors, Oracle HCM and ADP rather than demanding you replace your system of record. Recruiters can read and override any conversation, which is more transparency than most AI hiring tools give their own operators. Since October 2025 it is Workday-owned, which removes the survival risk and puts it inside a talent-acquisition suite alongside HiredScore.
Honest dings
The July 2025 McHire incident is the headline: a dormant 2019 test account with 123456 as both username and password, no MFA, plus an IDOR on an internal API, let two researchers reach 64 million candidate chat records. Paradox disputes the framing — it says those are chat records, not 64 million applicants, and many contain no personal data — and it patched same-day, added a bug bounty and tightened password rules. It still happened at a company holding ISO 27001 and SOC 2 Type II since 2019, on an account that survived penetration tests. Beyond security: no published bias or AEDT audit for the screening logic, no eval surface, no model disclosure, and reviewers report Olivia dead-ending on anything outside its configured script. Pricing is quote-only with an implementation fee, and the ROI case needs hundreds of hires a year.
Sources (14) — every claim traceable
Every audit lists the research it rests on — transparency and traceability are the product. Tools evolve: each audit is a snapshot of its audit date, and re-audits supersede older versions (kept below for reference).
- newsroom.workday.com/2025-10-01-Workday-Completes-A… — Official: acquisition completed 01/10/2025; Workday Paradox Candidate Experience Agent generally available, positioned with HiredScore and Workday Recruiting (accessed 2026-08-23)
- orrick.com/en/News/2025/08/AI-Powered-Talent-Acquis… — Deal counsel confirming the price: US $1 billion in cash, subject to customary adjustments (accessed 2026-08-23)
- paradox.ai — Official product surface: job search and apply, screening, scheduling, candidate prep, video interviewing, offers, onboarding, hiring events, referrals, surveys; named customer outcomes (accessed 2026-08-23)
- paradox.ai/security — Official security page: ISO 27001, SOC 2 Type II, EU-U.S. / UK / Swiss-U.S. Data Privacy Framework participation (accessed 2026-08-23)
- apps.adp.com/apps/417358 — Vendor-authored marketplace listing: 200+ organisations, 60+ countries, 100+ languages, SMS/WhatsApp/WeChat/Messenger channels, ADP Workforce Now and WOTC integration (accessed 2026-08-23)
- wired.com/story/mcdonalds-ai-hiring-chat-bot-parado… — Primary reporting on the July 2025 McHire breach: 123456 admin credentials, IDOR, ~64M records, Paradox CLO Stephanie King on record (accessed 2026-08-23)
- darkreading.com/application-security/lessons-learne… — Paradox's counter-position: 64 million chat records, not 64 million applicants; many records contain no personal information (accessed 2026-08-23)
- netizen.net/news/post/6661/paradox-ai-breach-mcdona… — Independent security write-up: SOC 2 Type II and ISO 27001 held since 2019 yet the test account survived penetration tests; separate 2024 contractor credential compromise in Vietnam (accessed 2026-08-23)
- workstream.us/blog/paradox-review — Independent review of the conversational ATS: job posting, applicant tracking, offers, open API and direct ATS/CRM/HCM connections (accessed 2026-08-23)
- hiretruffle.com/blog/paradox-ai-pricing — Pricing planning ranges (from ~$1,000/month; $30k–$95k/yr mid-size; $15k–$35k implementation) and Paradox's own 189M-conversation count (accessed 2026-08-23)
- hirevire.com/blog/paradox-ai-reviews-pricing-and-al… — Second independent pricing source verified 08/08/2026 against G2, Capterra and Workday's investor newsroom; entry $12k/yr, implementation $15k–$35k, no trial (accessed 2026-08-23)
- index.dev/blog/paradox-ai-recruitment-chatbot-review — Independent feature and limitation breakdown: 100+ languages, Traitify-based assessments, ROI needs 500+ annual hires, mixed candidate sentiment, breach flagged as vendor risk (accessed 2026-08-23)
- newsroom.workday.com/2025-06-03-Workday-Announces-N… — Official Workday commitment to MCP and A2A through Agent Gateway and the Agent System of Record (accessed 2026-08-23)
- doozy.live/blog/workday-mcp — Independent check (April 2026): no public Workday MCP server in the official registry, developer docs or GitHub despite the 2025 commitment (accessed 2026-08-23)