An Autonomous AI Agent Breached the "Lilli" Platform in Two Hours, Reaching 46.5 Million Messages

The event

In March 2026, security startup CodeWall ran an autonomous offensive AI agent against McKinsey's internal generative-AI platform "Lilli," used by roughly 40,000 consultants. With no credentials and no human in the loop, the agent gained full read-and-write access to the production database in about two hours. It found 22 unauthenticated API endpoints exposed in public documentation, then exploited a SQL injection flaw in how Lilli processed search queries -- JSON field names (not just values) were concatenated directly into SQL statements instead of being parameterized. By reading the error messages reflected back, the agent iteratively mapped the database and reached live production data. The attack chain demonstrated access to 46.5 million chat messages covering strategy, M&A, and client engagements, 728,000 files, and 57,000 user accounts, plus write access to the system "prompt layer" that governs Lilli's behavior and guardrails. This was an authorized responsible-disclosure exercise: CodeWall notified McKinsey on March 1, 2026. McKinsey, supported by a third-party forensics firm, said it found no evidence that client data or confidential information was accessed and that it patched all exposed endpoints by March 2; a company source told the Financial Times the underlying files were "never at risk."