This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
CodeWall's autonomous offensive agent identified and exploited an unauthenticated SQL injection vulnerability in McKinsey's internal AI platform, Lilli. The agent gained read and write access to sensitive production data, including millions of internal chat messages, proprietary research documents, and system prompts. McKinsey patched the vulnerability after responsible disclosure, confirming no evidence of client data access.
CodeWall reported that its autonomous agent exploited vulnerabilities in McKinsey's Lilli AI platform and obtained unauthorized read and write access to production systems, allegedly exposing internal chat messages, files, user accounts, and prompts. McKinsey confirmed the vulnerability and said it fixed the issue within hours, but said it found no evidence that client data or client confidential information were accessed.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
The security exploit resulted in unauthorized access to 46.5 million private chat messages and 57,000 employee accounts.
The incident involved an autonomous AI agent exploiting a critical SQL injection vulnerability in McKinsey's Lilli AI platform, leading to unauthorized database access.
AI system
Due to a decision or action made by an AI system
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The exploit was executed autonomously by CodeWall's offensive AI agent, which intentionally targeted and navigated the database vulnerability to retrieve data.
An autonomous offensive AI agent developed by CodeWall successfully exploited a critical SQL injection vulnerability in McKinsey's internal AI platform, Lilli. While the agent accessed millions of internal messages and proprietary documents, the incident was resolved via responsible disclosure, resulting in minor economic and technological security implications but demonstrating powerful autonomous cyber-offensive capabilities.
The report describes CodeWall's system as an 'autonomous offensive agent' that autonomously selected McKinsey as a target, mapped the attack surface, and executed a complex, multi-step SQL injection attack without a human-in-the-loop.
Limited Risk: Lilli is an internal corporate chatbot and document search system, which falls under Risk Level 3 (Limited Risk) as a chatbot system.
Lilli is an internal AI platform designed for chat, document analysis, and RAG-based search over McKinsey's proprietary documents.
The report from CodeWall provides highly detailed technical information about the vulnerability, the exploit chain, and the specific quantities of data accessed. The timeline of responsible disclosure and McKinsey's response is clearly documented, leaving very little ambiguity about the events.
None; this is a straightforward security disclosure of a vulnerability exploit.
Technology
Unsecured API Endpoints
Twenty-two API endpoints were left publicly accessible without authentication.
SQL Injection in JSON Keys
JSON keys were concatenated directly into SQL queries, causing vulnerability.
Lack of Prompt Layer Security
System prompts were stored in the database without separate access controls.
Data Inputs
Plaintext Chat Storage
Sensitive chat messages were stored in plaintext, enabling easy data theft.
Exposed RAG Metadata
RAG document chunks and S3 paths were accessible via database access.
Human Factors
Overtrust in AI Outputs
Consultants blindly trusted Lilli, making them vulnerable to poisoned prompts.
Process and Methods
Inadequate Vulnerability Assessment
OWASP ZAP and internal scanners failed to detect the custom SQL injection.
Insufficient Prompt Monitoring
No process existed to monitor or version control changes to system prompts.
Public Exposure of API Docs
API documentation was publicly exposed, aiding the attacker in mapping.
Management
Inadequate Risk Assessment of AI
Management failed to identify prompts as high-value assets needing protection.
Lack of AI Data Protection Policies
No strict security controls were mandated for the AI prompt layer database.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
