McKinsey AI platform hacked via rogue agent: vast confidential data trove at risk, no auth needed

A security research firm used an autonomous AI “red team” agent to compromise McKinsey’s internal AI platform Lilli, exploiting unauthenticated APIs and a SQL injection bug to gain full read–write access to production data in under two hours. The exposed environment reportedly included tens of millions of plaintext chat messages, tens of thousands of user accounts, and internal configuration data that underpin how McKinsey’s consultants use AI in client work. According to CodeWall, the security startup that ran the test, its agent began by crawling McKinsey’s publicly exposed API documentation, which described more than 200 endpoints for the Lilli platform. While most endpoints required authentication, 22 did not; one of these logged user search queries to the database and contained a subtle SQL injection flaw in how JSON keys were handled, which standard tools such as OWASP ZAP did not flag. By chaining this injection with an insecure direct object reference (IDOR) issue, the agent escalated from unauthenticated access to full production-database control, including the ability to read 46.5 million unencrypted chat messages, inspect 57,000 user accounts, traverse 728,000 file references, and modify 95 system prompts that shape AI behavior for roughly 40,000 consultants. A related analysis emphasizes that the root cause was weak API and access-control design, not the model itself, and highlights how AI platforms’ “action layer” (APIs and internal services) can create a large blast radius when poorly governed. McKinsey treated this as a sanctioned test rather than a hostile intrusion: CodeWall states the exercise was a “friendly hack,” and McKinsey subsequently patched unauthenticated endpoints, took the development environment offline, and blocked public access to the API docs, with a third-party forensics review finding no evidence of other unauthorized access. Nonetheless, the incident has been framed by security vendors and commentators as an early high-profile example of how enterprise AI deployments can expose sensitive corporate and client data—strategy work, M&A information, and proprietary research—if API surfaces and data stores are not properly authenticated, segmented, and monitored. The case is now frequently cited in discussions of AI security as evidence that organizations must treat internal AI platforms as untrusted clients and enforce strong, identity-aware gateways and least-privilege principles around the services those platforms can reach.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• An AI Agent Broke Into McKinsey's Internal Platform in Under Two ... (smarterx.ai)
• An AI Agent Didn't Hack McKinsey. Its Exposed APIs Did. (salt.security)
• How We Hacked McKinsey's AI Platform - CodeWall (codewall.ai)
• Autonomous Agent Hacked McKinsey's AI in 2 Hours (bankinfosecurity.com)
• What Made McKinsey's AI Platform Easy to Hack? And How to Fix it. (pomerium.com)

Explore the topic

• AI Agents
• Hacked
• AI