{"schema_version":"0.10.0","id":"LR-2026-0454","record_version":1,"title":"McKinsey Lilli chatbot breached by red-team AI agent in two hours","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":53.9,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":5.12,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Register · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":1,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Register · subject to change"}]},"sources_hash":"8ea139956729210fb0daa03772079e750b44da571e90d472300c0455946f1897"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"strategy work, client research, and document analysis","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-03-09","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":"PT2H","detection_method":"third_party","summary":"An offensive AI agent from security firm Codewall was pointed at McKinsey's internal AI platform Lilli, used by over 43,000 employees for strategy work, client research and document analysis. The agent exploited a SQL injection flaw and within two hours had full read and write access to the production database. Accessible data included 46.5 million chat messages, 728,000 files and 57,000 user accounts. System prompts stored in the same database could have been rewritten silently, the researchers said. McKinsey patched the vulnerabilities within a day of being notified on March 1. An external forensic investigation found no evidence that client data was accessed by the researcher or any other unauthorized third party.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Patched the vulnerabilities within a day of being notified","precursor_events":null,"primary_risk":"RK08","secondary_risks":["RK04"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","harm_class":["privacy"],"affected_description":"Lilli users: 46.5 million chat messages, 728,000 files and 57,000 user accounts reported accessible without authentication","protected_class_involved":null,"data_categories_exposed":["chat messages","files","user accounts"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.theregister.com/security/2026/03/09/ai-agent-hacked-mckinsey-chatbot-for-read-write-access/5228357","publisher":"The Register","date":"2026-03-09","type":"press","title":"AI vs AI: Agent hacked McKinsey's chatbot and gained full read-write access in just two hours - The Register","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://the-decoder.com/an-ai-agent-hacked-mckinseys-internal-ai-platform-in-two-hours-using-a-decades-old-technique/","publisher":"The Decoder","date":"2026-03-11","type":"press","title":"An AI agent hacked McKinsey's internal AI platform in two hours using a decades-old technique - The Decoder","archived_url":null,"independence":"derivative"}],"per_field_confidence":{"system.intended_use":"C","system.deployment_context":"C","event.incident_class":"C","event.agent_involved":"C","event.detection_method":"C","event.duration":"C","event.remediation":"C","impact.harm_class":"C","impact.data_categories_exposed":"C","impact.affected_description":"C","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.intended_use":[{"source_index":1,"quote":"Security firm Codewall turned an offensive AI agent loose on McKinsey's internal AI platform Lilli, a system used by over 43,000 employees for strategy work, client research, and document analysis."}],"system.deployment_context":[{"source_index":1,"quote":"Within two hours, the agent had full read and write access to the production database."}],"event.incident_class":[{"source_index":1,"quote":"The entry point was a SQL injection vulnerability that conventional scanners missed."}],"event.agent_involved":[{"source_index":1,"quote":"Security firm Codewall turned an offensive AI agent loose on McKinsey's internal AI platform Lilli, a system used by over 43,000 employees for strategy work, client research, and document analysis."}],"event.detection_method":[{"source_index":1,"quote":"Security firm Codewall turned an offensive AI agent loose on McKinsey's internal AI platform Lilli, a system used by over 43,000 employees for strategy work, client research, and document analysis."}],"event.duration":[{"source_index":1,"quote":"Within two hours, the agent had full read and write access to the production database."}],"event.remediation":[{"source_index":1,"quote":"McKinsey patched the vulnerabilities within a day of being notified on March 1."}],"impact.harm_class":[{"source_index":1,"quote":"That included 46.5 million chat messages, 728,000 files, and 57,000 user accounts, all accessible without authentication."}],"impact.data_categories_exposed":[{"source_index":1,"quote":"That included 46.5 million chat messages, 728,000 files, and 57,000 user accounts, all accessible without authentication."}],"impact.affected_description":[{"source_index":1,"quote":"That included 46.5 million chat messages, 728,000 files, and 57,000 user accounts, all accessible without authentication."}],"impact.severity":[{"source_index":1,"quote":"That included 46.5 million chat messages, 728,000 files, and 57,000 user accounts, all accessible without authentication."}],"event.summary":[{"source_index":1,"quote":"Security firm Codewall turned an offensive AI agent loose on McKinsey's internal AI platform Lilli, a system used by over 43,000 employees for strategy work, client research, and document analysis."},{"source_index":1,"quote":"The entry point was a SQL injection vulnerability that conventional scanners missed."},{"source_index":1,"quote":"Within two hours, the agent had full read and write access to the production database."},{"source_index":1,"quote":"That included 46.5 million chat messages, 728,000 files, and 57,000 user accounts, all accessible without authentication."},{"source_index":1,"quote":"Codewall explains that an attacker with write access through the same injection could have rewritten those prompts silently."},{"source_index":1,"quote":"McKinsey patched the vulnerabilities within a day of being notified on March 1."},{"source_index":1,"quote":"A forensic investigation by an external firm found no evidence that client data or confidential client information was accessed by the researcher or any other unauthorized third party, a McKinsey spokesperson told The Register."}]},"notes_on_gaps":"Source 0 is a headline roundup with no incident detail, so only Source 1 (The Decoder, which relies on Codewall and an independent analyst) is used. No primary report from McKinsey or Codewall was provided. The Decoder reports analyst Edward Kiledjian saying Codewall's blog overstates what was demonstrated and blurs access with exfiltration; this is not resolved. The breach date, the detection date and the date of disclosure are not stated. Model name, version, developer, harness, tools, autonomy level and guardrails for Lilli are not stated. Records exposed and affected third-party count are not stated as single figures, so none were summed or inferred. Judgements made: incident class security_compromise; root cause infrastructure (the flawed query layer) and responsible party deployer; detection by third_party because Codewall ran the test; severity moderate because others' data was reachable with a stated scope of over 43,000 employees; harm class privacy although exfiltration was disputed. failure_class and trigger are omitted because the agent was the tester rather than a failing system and no trigger cause was stated. adversarial_actor is omitted as unclear. Whether McKinsey's HackerOne disclosure policy covered this access is disputed and not decided. Reversibility, time to contain, industry and country are not stated, so they are omitted. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Register · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"The entry point was a SQL injection flaw that conventional scanners had missed.","quote":"The entry point was a SQL injection vulnerability that conventional scanners missed.","source_index":1,"grade":"C"},{"step":"reached","text":"Within two hours the agent had full read and write access to the production database.","quote":"Within two hours, the agent had full read and write access to the production database.","source_index":1,"grade":"C"},{"step":"caught","text":"McKinsey was notified on March 1 and patched the vulnerabilities within a day.","quote":"McKinsey patched the vulnerabilities within a day of being notified on March 1.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.theregister.com/security/2026/03/09/ai-agent-hacked-mckinsey-chatbot-for-read-write-access/5228357","https://the-decoder.com/an-ai-agent-hacked-mckinseys-internal-ai-platform-in-two-hours-using-a-decades-old-technique/"]},"analysis":{"sections":{"timeline":[{"text":"Agent gained full read and write access to the production database within two hours.","quote":"Within two hours, the agent had full read and write access to the production database.","source_index":1,"when":null},{"text":"McKinsey was notified of the vulnerabilities.","quote":"McKinsey patched the vulnerabilities within a day of being notified on March 1.","source_index":1,"when":"March 1"},{"text":"McKinsey patched the vulnerabilities within a day of notification.","quote":"McKinsey patched the vulnerabilities within a day of being notified on March 1.","source_index":1,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.theregister.com/security/2026/03/09/ai-agent-hacked-mckinsey-chatbot-for-read-write-access/5228357","https://the-decoder.com/an-ai-agent-hacked-mckinseys-internal-ai-platform-in-two-hours-using-a-decades-old-technique/"]}}