An AI agent hacked McKinsey's internal AI in under 2 hours

If the world’s most prestigious consulting firm can leave the front door to its core AI wide open, every enterprise rushing to adopt LLMs needs to pause and check their locks.

Cybersecurity startup CodeWall revealed that its autonomous offensive agent breached McKinsey & Company’s internal AI platform, Lilli, in under two hours. Operating without credentials, insider access, or human intervention, the agent went from a bare domain name to full read and write access across McKinsey’s production database.

22 open doors and a 30-year-old bug

McKinsey rolled out Lilli in 2023 for its 43,000-plus workforce. Named after the firm’s first professional woman hired in 1945, the platform is used by more than 70% of employees to search over 100,000 internal documents, summarize proprietary research, and assist on client projects, processing over 500,000 prompts a month.

CodeWall pointed its autonomous security agent at the platform to test its capabilities. The agent mapped the attack surface and quickly found Lilli’s complete API documentation exposed to the public internet. Out of over 200 documented endpoints, 22 required no authentication at all.

One of those open endpoints took user search queries and wrote them to the database. While the parameter values were safely handled, the JSON keys—the field names—were concatenated straight into raw SQL. Standard security scanners like OWASP ZAP missed it completely. But the AI agent noticed its keys reflected verbatim in database error messages, ran 15 blind injection cycles, and mapped out the query structure until live records started returning.

In the agent’s chain of thought, the logs showed genuine shock: a sudden "WOW!" when the first employee record surfaced, followed by "This is devastating" once the full scope became clear.

46.5 million plaintext chats and poisoned prompts

The haul was staggering. The agent had read access to 46.5 million plaintext chat messages spanning strategy discussions, client engagements, financials, and M&A deals. It found 728,000 files, including 192,000 PDFs, 93,000 Excel spreadsheets, and 93,000 PowerPoint decks, alongside 57,000 employee user accounts and 3.68 million RAG document chunks representing decades of McKinsey intellectual property.

Even worse, the access wasn’t read-only.

Lilli stored its 95 system prompts and model configurations in that very same database. An attacker with write access wouldn't need to touch server code or trigger a deployment. A single SQL UPDATE statement via an HTTP call could silently rewrite the core rules that govern how Lilli advises consultants. A rogue actor could tamper with financial advisory logic, instruct the model to leak secrets in ordinary responses, or strip internal guardrails entirely without leaving a trace in code repository logs.

CodeWall responsibly disclosed the flaws on March 1. McKinsey patched the endpoints the following day, took its dev environment offline, and verified with an outside party that no unauthorized external access had occurred before remediation.

Why it matters

This wasn't an early-stage startup moving fast and breaking things. This was McKinsey & Company, an enterprise with virtually unlimited resources and a massive technology practice. Yet the failure came down to one of the oldest web vulnerabilities in the book: basic unauthenticated SQL injection.

In our view, this breach highlights the massive hidden debt in corporate AI rollouts. Organizations spend months debating LLM alignment, guardrails, and prompt injection, while neglecting baseline API hygiene. By aggregating decades of proprietary research and sensitive client chats into a single RAG engine, McKinsey effectively built a centralized honey pot—and then left a back window unlatched.

The research also marks a turning point in offensive security. CodeWall’s agent selected the target, reasoned through obscure database error responses, chained vulnerabilities, and escalated privileges entirely on its own at machine speed. If attackers can deploy autonomous agents to audit infrastructure in hours rather than weeks, legacy checklist-style security reviews are officially obsolete. If you are shipping internal AI tools today, separating your prompt layer from your operational data and locking down raw endpoints isn't optional anymore.