Case mckinsey-lilli-breachModel & data leakUnited States
Autonomous AI agent breaches McKinsey's Lilli chatbot platform in two hours
CodeWall's offensive agent found SQL injection via unauthenticated Lilli API endpoints, claiming read-write access to 46.5M chat messages and system prompts; McKinsey patched within a day.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Mar 9, 2026
- Location
- United States
- Target
- McKinsey Lilli AI platform
- Severity
- High
- Triggered by
- CodeWall autonomous offensive AI agent (responsible disclosure)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
CodeWall's offensive agent found SQL injection via unauthenticated Lilli API endpoints, claiming read-write access to 46.5M chat messages and system prompts; McKinsey patched within a day.
Impact: Claimed access to 46.5 million chat messages, 728,000 files, 57,000 user accounts and 95 writable system prompts; no malicious exploitation reported.
Who triggered it
Actor: CodeWall autonomous offensive AI agent (responsible disclosure)
Attribution: Self-disclosed by CodeWall; McKinsey confirmed patching
Motive: Security research demonstrating autonomous agent capability
How it happened
Attack vector: 22 unauthenticated API endpoints; SQL injection via JSON keys concatenated into queries, plus broken access control on user IDs
Root cause: Unauthenticated endpoints and unsanitized JSON field names in SQL, with prompts, files, configs and user data stored in one backend
Timeline
- CodeWall agent gains read-write access in under two hours in late February
- CodeWall notifies McKinsey security team
- McKinsey patches exposed endpoints and takes dev environment offline
- CodeWall publishes findings
Response
McKinsey patched within a day and took the environment offline; CodeWall and Promptfoo published analyses.
Current status: Patched
Sources (open in a new tab)
- The Register theregister.com
- BankInfoSecurity bankinfosecurity.com
- Outpost24 outpost24.com
Cite this case
Autonomous AI agent breaches McKinsey's Lilli chatbot platform in two hours. AI Threat Watch, case mckinsey-lilli-breach, Mar 9, 2026. https://aithreat.io/cases/mckinsey-lilli-breach/
Permanent link: https://aithreat.io/cases/mckinsey-lilli-breach/