Eightfold AI Scored Job Applicants in Secret and Never Had to Say So

What happened

Every time a job applicant submitted a resume through a company portal powered by Eightfold AI, a score followed their application. The number ranked their fit and predicted their success. The applicant did not know the score existed, had no right to see it, and could not correct the data that generated it. A proposed class-action lawsuit filed in California in January 2026 says that arrangement violated federal consumer reporting law.

Plaintiffs Erin Kistler and Sruti Bhaumik applied for positions at PayPal and Microsoft in late 2025 through portals running on Eightfold's platform. Both received automated rejections. Neither was told that a proprietary algorithm had graded them before any human reviewer reached their materials, or that the grade may have depended on behavioral data gathered outside the application itself.

The lawsuit, Kistler v. Eightfold AI, claims the system draws on tracking cookies, internet activity, and location data to infer personality traits, labeling candidates as "introverts" or "team players" based on signals the candidates never provided directly and cannot verify. Under the Fair Credit Reporting Act, companies that compile consumer information and sell it to employers for hiring decisions are required to give applicants notice, obtain consent, and provide a mechanism for disputing errors. Eightfold, the suit argues, has been functioning as exactly that kind of consumer reporting agency while treating itself as exempt.

The legal ground shifted in the years before the filing. In early 2024, the Consumer Financial Protection Bureau issued guidance stating that AI hiring vendors generating algorithmic scores for employers likely qualify as consumer reporting agencies under federal law. The Trump administration rescinded that guidance in May 2025, leaving the same conduct the CFPB had flagged in a regulatory no-man's-land. Eightfold's algorithms remain proprietary. Employers using the platform have no independent way to audit what signals drove a rejection, and applicants have no path to contest a score they were never shown.

That absence is the structural problem the lawsuit surfaces. A job applicant rejected by an algorithm built on inferred behavioral data has, at this moment, no right to a provable record of what a system did when it evaluated them, who set the parameters, or what data it used. Accountability infrastructure of that kind would not resolve the legal classification dispute at the center of the case, but it would make the problem visible before thousands of applicants lose opportunities they can never trace back to a number assigned without their knowledge or consent.

Reported impact

Affected parties

Not publicly disclosed

Harm type

Not publicly disclosed

Scale

Not publicly disclosed

Financial impact

Not publicly disclosed

Regulatory action

Not publicly disclosed

Classification

Organization

Not publicly disclosed

AI system

Not publicly disclosed

Industry

Not publicly disclosed

Country

Not publicly disclosed

Provider

Not publicly disclosed

Incident type

Not publicly disclosed

Relevant governance controls

Governance control mapping is not available for this record.

• No controls mappedNot publicly disclosed

Control mapping is analytical. It does not state that any control would have prevented the incident.

Sources and evidence

This record was researched and written by the Index. The event is also catalogued in the following database, which is listed for cross-reference.