{"schema_version":"0.10.0","id":"LR-2026-0451","record_version":1,"title":"McKinsey AI chatbot Lilli breached via exposed endpoints and SQL injection","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":48.0,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":5.12,"unhedged_language":4.38},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"6dc144b74a50b241a269a9d5d62fbe50642de3e93379249a7dd24e0c1dd28027"},"system":{"model_name":null,"model_version":null,"developer":"McKinsey & Company","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-03-20","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"McKinsey & Company’s internal chatbot Lilli, first released in 2023, was reportedly breached by an offensive AI security agent. The reported exposure covered private files, chat logs and proprietary RAG documentation. According to reports, 22 exposed endpoints did not require authentication, and one had a SQL injection flaw. The breach reportedly took about two hours and $20 in tokens and gave access to sensitive data. Codewall, a startup whose researcher exposed the incident, published details of the hack. McKinsey said it fixed all identified issues within hours of learning of them. Its investigation found no evidence that client data was accessed by the researcher or any other unauthorised third party.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"infrastructure","root_cause_detail":"22 exposed endpoints did not require authentication, and one had a SQL injection flaw","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Fixed all issues identified by CodeWall within hours of learning about the problems","precursor_events":null,"primary_risk":"RK08","secondary_risks":["RK07","RK04"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Minor test: contained to one deployer (McKinsey) and the firm's own investigation found no evidence that client data or other third parties were accessed.","harm_class":[],"affected_description":"Internal chatbot Lilli: reported exposure of over 728,000 private files and more than 46 million chat logs, plus proprietary RAG documentation","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.consultancy.uk/news/43493/mckinsey-ai-chatbot-hacked-to-potentially-access-thousands-of-files","publisher":"Consultancy.uk","date":"2026-03-20","type":"press","title":"McKinsey AI chatbot hacked to potentially access thousands of files - Consultancy.uk","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.developer":"C","event.incident_class":"C","event.agent_involved":"C","event.detection_method":"C","event.root_cause":"C","event.root_cause_detail":"C","event.remediation":"C","impact.affected_description":"C","context.industry":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"McKinsey & Company has reportedly seen its internal chatbot – released three years ago – hacked, in a move which could potentially have exposed millions of the firm’s private conversations."}],"event.incident_class":[{"source_index":0,"quote":"McKinsey & Company has reportedly seen its internal chatbot – released three years ago – hacked, in a move which could potentially have exposed millions of the firm’s private conversations."}],"event.agent_involved":[{"source_index":0,"quote":"As a result, it took just two hours and $20 in tokens for an offensive AI security agent at the company to breach the multinational consultancy and gain access to highly sensitive data."}],"event.detection_method":[{"source_index":0,"quote":"According to Paul Price, a former Schillings cybersecurity consultant whose startup Codewall exposed the incident, the vulnerability was due to 22 exposed endpoints, which didn’t require authentication – one of which turned out to have a SQL injection flaw."}],"event.root_cause":[{"source_index":0,"quote":"According to Paul Price, a former Schillings cybersecurity consultant whose startup Codewall exposed the incident, the vulnerability was due to 22 exposed endpoints, which didn’t require authentication – one of which turned out to have a SQL injection flaw."}],"event.root_cause_detail":[{"source_index":0,"quote":"According to Paul Price, a former Schillings cybersecurity consultant whose startup Codewall exposed the incident, the vulnerability was due to 22 exposed endpoints, which didn’t require authentication – one of which turned out to have a SQL injection flaw."}],"event.remediation":[{"source_index":0,"quote":"A McKinsey spokesperson told The Register that it fixed all of the issues identified by CodeWall within hours of learning about the problems."}],"impact.affected_description":[{"source_index":0,"quote":"As reported by The Stack, the strategy giant’s internal chatbot ‘Lilli’ – which the firm first released in 2023 – exposed over 728,000 private files and more than 46 million chat logs, as well as proprietary RAG documentation to hackers."}],"context.industry":[{"source_index":0,"quote":"As a result, it took just two hours and $20 in tokens for an offensive AI security agent at the company to breach the multinational consultancy and gain access to highly sensitive data."}],"impact.severity":[{"source_index":0,"quote":"They insisted the firm’s own investigation “identified no evidence that client data or client confidential information were accessed by this researcher or any other unauthorised third party”."}],"impact.severity_because":[{"source_index":0,"quote":"They insisted the firm’s own investigation “identified no evidence that client data or client confidential information were accessed by this researcher or any other unauthorised third party”."}],"event.summary":[{"source_index":0,"quote":"As reported by The Stack, the strategy giant’s internal chatbot ‘Lilli’ – which the firm first released in 2023 – exposed over 728,000 private files and more than 46 million chat logs, as well as proprietary RAG documentation to hackers."},{"source_index":0,"quote":"According to Paul Price, a former Schillings cybersecurity consultant whose startup Codewall exposed the incident, the vulnerability was due to 22 exposed endpoints, which didn’t require authentication – one of which turned out to have a SQL injection flaw."},{"source_index":0,"quote":"As a result, it took just two hours and $20 in tokens for an offensive AI security agent at the company to breach the multinational consultancy and gain access to highly sensitive data."},{"source_index":0,"quote":"A McKinsey spokesperson told The Register that it fixed all of the issues identified by CodeWall within hours of learning about the problems."},{"source_index":0,"quote":"They insisted the firm’s own investigation “identified no evidence that client data or client confidential information were accessed by this researcher or any other unauthorised third party”."}]},"notes_on_gaps":"Single press source (Consultancy.uk, citing The Stack, The Register and a Codewall blog post); no primary report. Not stated: date the breach occurred, date of disclosure (publication date 2026-03-20 not used as disclosure date), model name and version of Lilli, underlying model, responsible party, number of affected third parties, records count (46 million chat logs and 728,000 files are reported as exposed, not as accessed), country, and harm class. Judgements: the offensive AI agent is the attacker's tool, so no failure_class was assigned to the system; SQL injection is not in the trigger list so no trigger was written; severity set to minor based on the firm's statement of one deployer and no third party touched, though the source describes the exposure as potentially large; the 'at the company' phrase in the breach sentence is ambiguous and was not used to assign the agent to McKinsey; J1 was chosen as the control added by the fix because the source says issues were fixed without naming a specific control; duration PT2H is the stated time for the breach, not the full incident. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":"consulting","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"McKinsey’s internal chatbot Lilli, first released in 2023, was in use inside the firm.","quote":"As reported by The Stack, the strategy giant’s internal chatbot ‘Lilli’ – which the firm first released in 2023 – exposed over 728,000 private files and more than 46 million chat logs, as well as proprietary RAG documentation to hackers.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Twenty-two exposed endpoints did not require authentication, and one had a SQL injection flaw.","quote":"According to Paul Price, a former Schillings cybersecurity consultant whose startup Codewall exposed the incident, the vulnerability was due to 22 exposed endpoints, which didn’t require authentication – one of which turned out to have a SQL injection flaw.","source_index":0,"grade":"C"},{"step":"reached","text":"An offensive AI security agent reportedly breached the system in about two hours and gained access to highly sensitive data.","quote":"As a result, it took just two hours and $20 in tokens for an offensive AI security agent at the company to breach the multinational consultancy and gain access to highly sensitive data.","source_index":0,"grade":"C"},{"step":"caught","text":"The incident was exposed by Codewall, a startup whose researcher publicised it.","quote":"According to Paul Price, a former Schillings cybersecurity consultant whose startup Codewall exposed the incident, the vulnerability was due to 22 exposed endpoints, which didn’t require authentication – one of which turned out to have a SQL injection flaw.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.consultancy.uk/news/43493/mckinsey-ai-chatbot-hacked-to-potentially-access-thousands-of-files"]},"analysis":{"sections":{"timeline":[{"text":"Lilli chatbot first released by the firm.","quote":"As reported by The Stack, the strategy giant’s internal chatbot ‘Lilli’ – which the firm first released in 2023 – exposed over 728,000 private files and more than 46 million chat logs, as well as proprietary RAG documentation to hackers.","source_index":0,"when":"2023"},{"text":"McKinsey fixed the identified issues within hours of learning about the problems.","quote":"A McKinsey spokesperson told The Register that it fixed all of the issues identified by CodeWall within hours of learning about the problems.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.consultancy.uk/news/43493/mckinsey-ai-chatbot-hacked-to-potentially-access-thousands-of-files"]}}