AI Broke Inbound Hiring. Here Is How to Fix It Without Getting Sued.

You posted the role on Monday morning. By Tuesday afternoon you had 400 applications. You opened the first 50, and within half an hour you noticed a pattern. The resumes were polished. The keywords were perfect. The cover letters were tailored. Something was wrong, and the wrong thing was that almost everything looked exactly the same.

You were not imagining it. You were looking at the output of a new class of tools that promise to apply a candidate to dozens or hundreds of roles a day for a monthly subscription. Consumer-facing services advertise plans priced between roughly $20 and $99 per month, with higher tiers authorizing up to 420 applications per month or 150 applications per day (Bureau). The tools scrape the posting, rewrite the resume to match, draft the cover letter, click submit, and move on to the next listing. The pitch to the candidate is "let the AI find you a job." The result for you is an inbox that looks like a fraud detection problem.

What makes this worse is that the obvious fix, which is to stop trusting the inbox and do all your hiring through outbound recruiter outreach, creates a different, larger problem. The inbox is broken for practical reasons. Outbound-only recruiting is broken for legal reasons. This post walks you through both problems and describes a defensible middle path.

Part One: The Inbox You Cannot Trust

Start with the mechanics. Reverse-recruiting tools are now widely available. A candidate creates an account. The tool ingests the candidate's resume, scans job boards for roles matching the candidate's stated criteria, generates a keyword-optimized version of the resume for each role, writes a tailored cover letter, and submits the application. The tool does this for thousands of users simultaneously, which means your role is being applied to by many people who never read your posting, never considered whether they were a fit, and never intended to be actually in your candidate pool. Nearly 40 percent of job seekers now admit to using AI to write their resumes, and some recruiters estimate that "easily 25%" of applications appear to be AI-generated (Morris).

The downstream effect shows up in three ways.

First, signal-to-noise collapses. Your genuine applicants, the ones who read the posting, considered the fit, and wrote something specific, are buried under hundreds of bot submissions that look superficially identical. Triaging takes longer. The best candidates may never surface.

Second, screening conversations waste the first ten minutes. The candidate who arrives through a bot submission often cannot speak to the specific role because the candidate never read the listing. Your recruiter spends the opening minutes of the call establishing that the candidate is not, in fact, the candidate the resume described.

Third, your team loses confidence in the inbox. Once a hiring manager has had enough of these experiences, the rational response is to stop opening the inbox at all. That is exactly how the inbound funnel becomes functionally dead even while it receives hundreds of applications.

Part Two: Why Outbound-Only Is A Legal Trap

Confronted with a broken inbox, many hiring teams pivot to outbound-only recruiting. A recruiter sources candidates directly, contacts them, advances the promising ones. The inbound funnel is ignored or closed entirely. The recruiter's curated list becomes the whole candidate pool.

This feels safer. This feels more efficient. This feels like a solution.

This is a legal exposure.

When the recruiter's personal selection drives the candidate pool, the pool reflects the recruiter's biases. Those biases may be unconscious, may be implicit, may be entirely unintended. The law does not require intent. A disparate-impact claim, brought under state or federal fair-employment law, looks at the statistical composition of the pool and the statistical composition of the hires. If the pool systematically underrepresents a protected class, and the sourcing mechanism is the recruiter's discretion, the employer owns the result.

California has sharpened this exposure further. The Civil Rights Council adopted new regulations, effective October 1, 2025, that expand the definition of "agent" under the Fair Employment and Housing Act (California Civil Rights Department). An agent is now "any person acting on behalf of an employer, directly or indirectly, to exercise a function traditionally exercised by the employer or any other FEHA-regulated activity" (Paul Hastings). Recruiting, screening, and hiring decisions sit squarely inside that definition. When the recruiter acts, the employer is on the hook.

The same regulations treat automated decision systems the same way. If you use an AI tool to filter resumes, rank candidates, or recommend interviews, you are responsible for the output. The tool's output is your output. The tool's disparate impact is your disparate impact. A federal court in Mobley v. Workday, Inc. recently held that an AI vendor may itself be liable as an employer's agent, a ruling that aligns with California's expanded agent doctrine (Seyfarth Shaw).

Outbound-only sourcing, paired with AI screening, creates a pool shaped by two layers of opaque discretion, each of which can produce discriminatory results, each of which the employer owns.

Part Three: A Defensible Middle Path

The fix is to restore inbound as a usable channel, to keep outbound running alongside it rather than in place of it, and to document the process so you can show your work later. Three moves.

Move one, restore inbound with an authentication layer. The reason the inbox is broken is that the cost of applying has collapsed to zero. A bot can submit a polished application in seconds. The fix is to raise the cost of applying in a way that filters bots and costs real candidates very little.

The mechanism that works is an authentication step that a bot cannot easily fake. A short video response to a role-specific question is the cleanest version. A bot can generate a resume, a bot can generate a cover letter, a bot cannot sit a real human in front of a camera for two minutes answering your specific question. A candidate who cannot spend ten minutes recording a video response is a candidate who did not really want the role. A candidate who does spend the ten minutes is a candidate worth considering.

This single move collapses the noise problem. Your inbound pool shrinks by 80 percent, the 80 percent that disappears is almost entirely noise, and the remaining 20 percent is a pool you can actually review.

Move two, keep outbound running alongside a usable inbound funnel. Outbound recruiting is a legitimate part of almost any search. Sourcing strong candidates, reaching out directly, building a pipeline through relationships -- none of that is the problem. The problem is the closed pool. When outbound becomes the only channel, the recruiter's discretion becomes the only filter, and the employer owns whatever the pool composition turns out to be.

The defensible posture is outbound running alongside an authenticated inbound funnel, not in place of one. A recruiter sourcing into a pipeline that also receives real inbound applicants gets the best of both: the quality of direct outreach and the breadth of an open pool that surfaces candidates the recruiter would never have found on their own. The legal exposure shrinks because the pool is no longer shaped by a single layer of opaque discretion. The recruiter's job gets easier because the inbound pool is finally worth looking at.

Move three, document every screening decision. This is the move that most small teams skip and that every plaintiffs' firm will ask about if there is ever a dispute. For each role, keep records of: the posting language, the pool composition, the screening questions used, the answers received, the advancement decisions made, and the reasons for each advancement or rejection. Keep the records for at least four years. California's new regulations require retention of "any data used in or resulting from the application of an [ADS]" for four years, and the same period is a sensible practice for manual screening decisions even outside California (Paul Hastings).

Documentation does three things at once. Documentation protects you if a dispute arises. Documentation forces the team to articulate decision criteria, which tends to improve the quality of decisions. Documentation makes audits possible, which is the first step toward catching bias before it becomes a claim.

What This Looks Like In Practice

A small firm we spoke with redesigned its hiring funnel along these lines. The firm replaced its open application form with a two-step process: a short application for basic information, followed by a one-question video response for candidates who wanted to be considered seriously. Inbound volume dropped from 300 to 40 per role. Screening time per role fell from roughly 12 hours to roughly 3 hours. The hiring manager's confidence in the inbox returned. Outbound continued to run in parallel, and the recruiter's sourced candidates moved through the same authenticated process as inbound applicants, producing a single pool that the team could compare evenly.

The firm also started keeping a simple record, per role, of the pool composition, the advancement decisions, and the reasons. The record took about 20 minutes per role to maintain. The firm has not yet needed the record. The record is there if the day comes.

The Role of McCoy

McCoy was built to be exactly the authentication layer described in Move one. A hiring team posts a role, generates a calibrated follow-up question, receives short video responses from real candidates, and reviews the responses on its own schedule. The tool does the authentication. The tool generates the role-specific questions that test for fit. The tool produces the documentation record that supports the defensible posture described in Move three. Outbound candidates can be invited through the same flow, so the recruiter's pipeline and the inbound pipeline merge into one reviewable pool.

You do not need McCoy to follow the logic of this post. The logic holds for any authentication step that filters bots at low cost to real candidates. We built McCoy because the need is real, the market has not solved it, and a pre-built layer is faster than building one in-house.

Three Quick Questions

Are the $29-per-month reverse-recruiting tools actually legal? The tools themselves are not illegal. The candidate who uses one has not broken any law. The problem the tools create for employers is volume and authenticity, not legality.

Does the California agent-liability rule apply to my company if I am based outside California? The rule applies when the employer is covered by California's Fair Employment and Housing Act. Any employer recruiting California applicants should assume the rule applies and get specific legal advice.

Do I need to keep hiring records for all my roles, or just California roles? California requires four years of ADS-related records. Even if you are outside California, keeping a four-year record of screening decisions is a sensible practice and is aligned with federal EEOC record-retention guidance for most situations.

This article is general commentary and does not constitute legal advice. Employers facing specific compliance questions should consult qualified counsel.

McCoy provides an authentication and documentation layer for hiring teams that want to restore inbound as a usable funnel. Learn more at McCoyIQ.com.

Works Cited

Bureau, Ryan. "2025's Best Auto-Apply Tools for Tech Job Seekers." Jobright.ai, 2025, jobright.ai/blog/2025s-best-auto-apply-tools-for-tech-job-seekers/.

California Civil Rights Department. "Civil Rights Council Secures Approval for Regulations to Protect Against Employment Discrimination Related to Artificial Intelligence." CRD, 30 June 2025, calcivilrights.ca.gov/2025/06/30/civil-rights-council-secures-approval-for-regulations-to-protect-against-employment-discrimination-related-to-artificial-intelligence/.

Morris, Chris. "Why AI Resumes Are Overwhelming Recruiters and Managers." Inc., inc.com/chris-morris/ai-resumes-overwhelming-recruiters-managers/91207016.

Paul Hastings LLP. "New California Regulations on Employers' Use of AI to Make Decisions Go Into Effect Oct. 1, 2025." Paul Hastings, 2025, paulhastings.com/insights/client-alerts/new-california-regulations-on-employers-use-of-ai-to-make-decisions-go-into-effect-oct-1-2025.

Seyfarth Shaw LLP. "Mobley v. Workday: Court Holds AI Service Providers Could Be Directly Liable for Employment Discrimination Under 'Agent' Theory." Seyfarth, seyfarth.com/news-insights/mobley-v-workday-court-holds-ai-service-providers-could-be-directly-liable-for-employment-discrimination-under-agent-theory.html.