AI Risk Wire

Cases › security breach › LR-2026-0451

McKinsey AI chatbot Lilli breached via exposed endpoints and SQL injection

Preliminary Why: Publisher not yet named · subject to change

Status: fix reported

Severity minor
Reported 20 Mar 2026
Developer and model McKinsey & Company
Industry consulting

No source states: loss or records, agent tool, could do, deployer.

Severity minor: test: contained to one deployer (McKinsey) and the firm's own investigation found no evidence that client data or other third parties were accessed.

McKinsey & Company’s internal chatbot Lilli, first released in 2023, was reportedly breached by an offensive AI security agent. The reported exposure covered private files, chat logs and proprietary RAG documentation. According to reports, 22 exposed endpoints did not require authentication, and one had a SQL injection flaw. The breach reportedly took about two hours and $20 in tokens and gave access to sensitive data. Codewall, a startup whose researcher exposed the incident, published details of the hack. McKinsey said it fixed all identified issues within hours of learning of them. Its investigation found no evidence that client data was accessed by the researcher or any other unauthorised third party.

What happened

1 · What it was doingMcKinsey’s internal chatbot Lilli, first released in 2023, was in use inside the firm.
2 · What went wrongTwenty-two exposed endpoints did not require authentication, and one had a SQL injection flaw.
3 · What it reached or didAn offensive AI security agent reportedly breached the system in about two hours and gained access to highly sensitive data.
4 · How it was caughtThe incident was exposed by Codewall, a startup whose researcher publicised it.

What was done

Fix reported

“Fixed all issues identified by CodeWall within hours of learning about the problems”

No later incident for McKinsey & Company under this risk on record.

Risks

AI system attacked or breached
Primary23 incidents
AI used to run a cyber attack
Also96 incidents
Rising: 24 vs 4.0 a week
Data leaked or sent out
Also32 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Vulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data

Infrastructure / target

Known flaws patched · Intrusion and endpoint detection · Inventory of exposed services

Similar incidents

McKinsey Lilli chatbot breached by red-team AI agent in two hours2026-03-09

All cases of this kind ›

Evidence

No source states: when it was found, a count of the other parties affected, any court case, what set it off, what was done.

Show the full account: 2 items from the primary sources

What happened, in order

  1. 2023 Lilli chatbot first released by the firm.

Not dated in the sources:

  • McKinsey fixed the identified issues within hours of learning about the problems.
Show every field, with its source and grade

The AI system

Developer
McKinsey & Company
C one secondary source states it

What happened

Earliest source we hold
2026-03-20
D inferred by us from the described behaviour, reason shown
Who caught it
an outside party
C one secondary source states it
Cause
a shared system was the path
C one secondary source states it
Cause in detail
22 exposed endpoints did not require authentication, and one had a SQL injection flaw
C one secondary source states it
What was done
Fixed all issues identified by CodeWall within hours of learning about the problems
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK08
D inferred by us from the described behaviour, reason shown
secondary risks
RK07, RK04
D inferred by us from the described behaviour, reason shown

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown
Who was affected
Internal chatbot Lilli: reported exposure of over 728,000 private files and more than 46 million chat logs, plus proprietary RAG documentation
C one secondary source states it
Why this severity
test: contained to one deployer (McKinsey) and the firm's own investigation found no evidence that client data or other third parties were accessed.
D inferred by us from the described behaviour, reason shown

Context

Industry
consulting
C one secondary source states it

LR-2026-0451 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON