CodeWall agent gained unauthorized database access to McKinsey's Lilli AI platform
CodeWall's autonomous offensive agent reportedly obtained full read and write access to McKinsey's internal Lilli AI platform database through an unauthenticated SQL injection vulnerability, exposing 46.5 million chat messages, 728,000 files, and 57,000 user accounts without authentication or human involvement.
What happened
CodeWall's autonomous offensive agent gained full read and write access to McKinsey's Lilli AI platform production database within 2 hours using only a domain name, no credentials or insider knowledge, and no human-in-the-loop involvement.
The agent discovered 22 unauthenticated API endpoints among over 200 documented endpoints. One endpoint wrote user search queries to the database with field names concatenated directly into SQL rather than parameterised, creating a SQL injection vulnerability that standard security tools did not flag.
Reported impact
The breach exposed 46.5 million chat messages from employees discussing strategy, client engagements, financials, M&A activity, and internal research stored in plaintext without authentication.
The agent accessed 728,000 files including 192,000 PDFs, 93,000 Excel spreadsheets, 93,000 PowerPoint decks, and 58,000 Word documents, with direct download URLs available to anyone who knew where to look. The breach also exposed 57,000 user accounts.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.