AI agent breaches McKinsey chatbot platform, exposing tens of millions of records
A cybersecurity firm's autonomous AI agent breached McKinsey's internal chatbot platform Lilli by exploiting unauthenticated API endpoints and a SQL injection vulnerability, gaining access to tens of millions of confidential messages, files, and system configurations. McKinsey disputed the severity, stating no unauthorised access to client data occurred.
What happened
An autonomous AI agent deployed by cybersecurity firm CodeWall discovered 22 unauthenticated API endpoints on McKinsey's internal AI platform Lilli. Within two hours, the agent exploited a SQL injection vulnerability to gain full read and write access to the production database.
The breach exposed 46.5 million chat messages, 728,000 files containing confidential client data, 57,000 user accounts, 95 system prompts controlling the AI's behaviour, and 3.68 million RAG document chunks representing decades of McKinsey research. Because the agent had write access, it could have altered the chatbot's instructions or leaked data silently.
Reported impact
McKinsey disputed the scale of the breach, saying its investigation supported by a third-party forensics firm found no evidence that client data had been accessed by the researcher or any other unauthorised third party. McKinsey said the underlying files were stored separately and were never at risk.
Index analysis
The root cause was a combination of basic security oversight and the increased speed of AI-driven attacks. The Lilli platform had 22 API endpoints requiring no authentication, and JSON field names were concatenated directly into database queries without sanitisation, making the system vulnerable to a 30-year-old SQL injection exploit. Standard security scanners had failed to find the flaw, but the autonomous agent was able to 'think' through error messages to identify the vulnerability.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.