TL;DR: Security startup CodeWall pointed an autonomous AI agent at McKinsey's internal AI platform Lilli on February 28, 2026. Within two hours (with no credentials, no insider help, no human guidance) the agent had full read-write access to the production database. The haul: 46.5 million chat messages discussing strategy, M&A, and client engagements. 728,000 files of confidential client data. 57,000 employee accounts. And the ability to rewrite the AI's system prompts, meaning attackers could have poisoned advice going to McKinsey's 30,000+ consultants. The vulnerability? SQL injection. A technique discovered in 1998.
What Happened
On March 9, 2026, CodeWall published a detailed breakdown of how its autonomous offensive agent compromised McKinsey's Lilli platform. The target wasn't random. The agent selected McKinsey itself after reviewing the firm's responsible disclosure policy and noting recent platform updates that suggested fresh attack surface.
The agent's first move: scan publicly exposed API documentation. It found over 200 endpoints. Twenty-two of them required no authentication at all.
One of those unprotected endpoints processed user search queries. The agent noticed that while the values were safely prepared, the JSON field names were concatenated directly into SQL. Database error messages reflected the input verbatim.
Classic SQL injection. The agent ran fifteen blind iterations, extracting progressively more data until it hit production.
What Was Exposed
CodeWall's agent gained full read-write access to McKinsey's production database. Here's what that means:
- 46.5 million chat messages: all in plaintext, covering strategy discussions, merger and acquisition talks, client engagements
- 728,000 files: including 192,000 PDFs, 93,000 spreadsheets, and equivalent numbers of presentations and documents
- 57,000 employee accounts: complete user profiles for McKinsey staff
- 384,000 AI assistants and 94,000 workspaces: mapping how the organization uses AI
- 3.68 million RAG document chunks: proprietary research accumulated over decades
- 95 system prompts for 12 AI model types: the instructions that control Lilli's behavior
The agent also discovered 1.1 million files flowing through external APIs, 266,000+ OpenAI vector stores, and IDOR vulnerabilities that exposed individual employees' search histories.
The Real Threat: Writable Prompts
Reading data is bad. Rewriting the AI is worse.
CodeWall's agent found that all 95 system prompts were stored in the same vulnerable database, and they were writable. With a simple UPDATE statement, an attacker could have modified the instructions controlling Lilli's outputs.
Imagine a malicious actor rewriting the prompts to:
- Poison strategic advice with subtle errors or biased recommendations
- Exfiltrate data through AI outputs by having Lilli include hidden instructions
- Remove safety guardrails and compliance warnings
- Establish persistence by hiding instructions that survive prompt updates
McKinsey employs roughly 30,000 consultants. They advise Fortune 500 companies, governments, and major institutions. Corrupted advice from a trusted internal tool could ripple outward for months before anyone noticed.
Timeline
- February 28, 2026: CodeWall's agent identifies SQL injection vulnerability and begins database enumeration
- March 1, 2026: CodeWall initiates responsible disclosure to McKinsey
- March 2, 2026: McKinsey patches all unauthenticated endpoints, takes development environment offline, blocks public API documentation
- March 9, 2026: CodeWall publishes public disclosure
McKinsey's response was fast: fixes deployed within hours of notification. But that speed doesn't change the fact that these endpoints sat exposed while Lilli served one of the world's largest consulting firms.
McKinsey's Statement
McKinsey confirmed the vulnerability in a public statement:
"McKinsey was recently alerted to a vulnerability related to our internal AI tool, Lilli, by a security researcher. We promptly confirmed the vulnerability and fixed the issue within hours. Additionally, investigation, supported by a leading third-party forensics firm, identified no evidence that client data or client confidential information were accessed by this researcher or any other unauthorized third party."
No evidence of unauthorized access beyond CodeWall. But twenty-two unauthenticated endpoints with SQL injection don't appear overnight. How long were they exposed?
The Bigger Picture: AI Agents vs. AI Agents
This isn't just a McKinsey story. It's a preview of what's coming.
Gartner estimates 40% of enterprise applications will integrate AI agents by the end of 2026. Every one of them is an attack surface. CodeWall CEO Paul Price put it bluntly: "This was fully autonomous from researching the target, analyzing, attacking, and reporting."
The attacker wasn't a team of hackers. It was software. It picked its own target, found its own vulnerability, and extracted the data without human intervention.
Now consider that most organizations rushing to deploy AI assistants are not McKinsey. They don't have McKinsey's security budget, McKinsey's responsible disclosure policy, or McKinsey's ability to patch within hours.
SQL injection was documented in 1998. Twenty-eight years later, it's still breaching enterprise platforms.
What to Watch
- Your company's AI tools: Ask your IT department what data your internal AI assistants can access. Ask if they've been penetration tested.
- System prompt security: CodeWall calls prompts "the new Crown Jewel assets." Are yours stored in production databases with write access?
- Autonomous security testing: If AI agents can hack McKinsey, they can hack you. Red team tools are going autonomous, and attackers will follow.
Sources
- CodeWall: How We Hacked McKinsey's AI Platform
- The Register: AI agent hacked McKinsey chatbot for read-write access
- McKinsey: Statement on Strengthening Safeguards Within the Lilli Tool
- NeuralTrust: How an AI Agent Hacked McKinsey and Exposed 46 Million Messages
- Cybernews: Red-teamers unleash AI agent on McKinsey's chatbot