AI Risk Wire

Cases › security breach › LR-2026-0454

McKinsey Lilli chatbot breached by red-team AI agent in two hours

Preliminary Why: 1 report: The Register · subject to change · 1 independent report

Status: fix reported

Severity moderate
Reported 9 Mar 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

An offensive AI agent from security firm Codewall was pointed at McKinsey's internal AI platform Lilli, used by over 43,000 employees for strategy work, client research and document analysis. The agent exploited a SQL injection flaw and within two hours had full read and write access to the production database. Accessible data included 46.5 million chat messages, 728,000 files and 57,000 user accounts. System prompts stored in the same database could have been rewritten silently, the researchers said. McKinsey patched the vulnerabilities within a day of being notified on March 1. An external forensic investigation found no evidence that client data was accessed by the researcher or any other unauthorized third party.

What happened

1 · What went wrongThe entry point was a SQL injection flaw that conventional scanners had missed.
2 · What it reached or didWithin two hours the agent had full read and write access to the production database.
3 · How it was caughtMcKinsey was notified on March 1 and patched the vulnerabilities within a day.

What was done

Fix reported

“Patched the vulnerabilities within a day of being notified”

Vulnerability scanning of AI components

Risks

AI system attacked or breached
Primary23 incidents
Data leaked or sent out
Also32 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Vulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data

Infrastructure / target

Known flaws patched · Intrusion and endpoint detection · Inventory of exposed services

Similar incidents

McKinsey AI chatbot Lilli breached via exposed endpoints and SQL injection2026-03-20

All cases of this kind ›

Evidence

No source states: what the AI was doing, when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 3 items from the primary sources

What happened, in order

  1. March 1 McKinsey was notified of the vulnerabilities.

Not dated in the sources:

  • Agent gained full read and write access to the production database within two hours.
  • McKinsey patched the vulnerabilities within a day of notification.
Show every field, with its source and grade

The AI system

Stage of use
in live use
C one secondary source states it
What it was for
strategy work, client research, and document analysis
C one secondary source states it

What happened

Earliest source we hold
2026-03-09
D inferred by us from the described behaviour, reason shown
How long it lasted
PT2H
C one secondary source states it
Who caught it
an outside party
C one secondary source states it
What was done
Patched the vulnerabilities within a day of being notified
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK08
D inferred by us from the described behaviour, reason shown
secondary risks
RK04
D inferred by us from the described behaviour, reason shown

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
privacy
C one secondary source states it
Who was affected
Lilli users: 46.5 million chat messages, 728,000 files and 57,000 user accounts reported accessible without authentication
C one secondary source states it
Kinds of data exposed
chat messages, files, user accounts
C one secondary source states it

Notes on gaps

No primary report from McKinsey or Codewall was provided. The Decoder reports analyst Edward Kiledjian saying Codewall's blog overstates what was demonstrated and blurs access with exfiltration; this is not resolved. Whether McKinsey's HackerOne disclosure policy covered this access is disputed and not decided.

LR-2026-0454 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON