CodeWall's Autonomous Agent Reportedly Obtained Unauthorized Access to McKinsey's Lilli AI Platform Database

CodeWall reported that its autonomous agent exploited vulnerabilities in McKinsey's Lilli AI platform and obtained unauthorized read and write access to production systems, allegedly exposing internal chat messages, files, user accounts, and prompts. McKinsey confirmed the vulnerability and said it fixed the issue within hours, but said it found no evidence that client data or client confidential information were accessed.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The incident involved an autonomous AI agent exploiting a critical SQL injection vulnerability in McKinsey's Lilli AI platform, leading to unauthorized database access.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The security exploit resulted in unauthorized access to 46.5 million private chat messages and 57,000 employee accounts.

Causal factors

• Entity: AI
• Intent: Intentional
• Timing: Post-deployment

The exploit was executed autonomously by CodeWall's offensive AI agent, which intentionally targeted and navigated the database vulnerability to retrieve data.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: Lilli is an internal corporate chatbot and document search system, which falls under Risk Level 3 (Limited Risk) as a chatbot system.

AI system and alleged parties

• AI system: CodeWall autonomous agent, Lilli (CodeWall)
• AI purpose: Chatbot; Content Search
• Behaviour type: Agent
• Alleged developer: McKinsey & Company, CodeWall
• Alleged deployer: McKinsey & Company, CodeWall
• Alleged harmed parties: McKinsey & Company employees, McKinsey & Company consultants, McKinsey & Company, Lilli users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: Yes, the report explicitly describes the exposure of millions of private chat messages and employee accounts.

Directly caused: The autonomous agent accessed 46.5 million chat messages, 728,000 files, and 57,000 user accounts containing sensitive personal and corporate data.

People affected

• Occurrences reported: 1
• People reportedly exposed: 57000

Potential causes

Management

• Inadequate Risk Assessment of AI: Management failed to identify prompts as high-value assets needing protection.
• Lack of AI Data Protection Policies: No strict security controls were mandated for the AI prompt layer database.

Technology

• Unsecured API Endpoints: Twenty-two API endpoints were left publicly accessible without authentication.
• SQL Injection in JSON Keys: JSON keys were concatenated directly into SQL queries, causing vulnerability.
• Lack of Prompt Layer Security: System prompts were stored in the database without separate access controls.

Data Inputs

• Plaintext Chat Storage: Sensitive chat messages were stored in plaintext, enabling easy data theft.
• Exposed RAG Metadata: RAG document chunks and S3 paths were accessible via database access.

Human Factors

• Overtrust in AI Outputs: Consultants blindly trusted Lilli, making them vulnerable to poisoned prompts.

Process and Methods

• Inadequate Vulnerability Assessment: OWASP ZAP and internal scanners failed to detect the custom SQL injection.
• Insufficient Prompt Monitoring: No process existed to monitor or version control changes to system prompts.
• Public Exposure of API Docs: API documentation was publicly exposed, aiding the attacker in mapping.

Information quality

• Classification confidence: High
• Reason for confidence: The report from CodeWall provides highly detailed technical information about the vulnerability, the exploit chain, and the specific quantities of data accessed. The timeline of responsible disclosure and McKinsey's response is clearly documented, leaving very little ambiguity about the events.
• Ambiguities identified: None significant; the technical exploit and data scale are clearly defined.
• Alternative interpretations: None; this is a straightforward security disclosure of a vulnerability exploit.

An autonomous offensive AI agent developed by CodeWall successfully exploited a critical SQL injection vulnerability in McKinsey's internal AI platform, Lilli. While the agent accessed millions of internal messages and proprietary documents, the incident was resolved via responsible disclosure, resulting in minor economic and technological security implications but demonstrating powerful autonomous cyber-offensive capabilities.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: CodeWall

Threat characteristics

• Imminence: Long-term. The vulnerability has been patched, and the incident represents a strategic capability demonstration rather than an active crisis.
• Autonomy: Full autonomy. The offensive AI agent autonomously mapped the attack surface and executed a multi-step SQL injection exploit without human intervention.
• Novelty: Evolved capability. Represents a significant advancement in automated offensive cyber capabilities, transitioning from traditional scripted exploits to autonomous AI-driven pentesting.

Impact by dimension

• Physical security: Negligible. No physical systems, kinetic threats, or critical infrastructure control systems were affected during this digital security assessment.
• Information security: Minor. While 46.5 million internal messages and proprietary research were accessed, the exploit was conducted by a security firm under responsible disclosure, preventing hostile intelligence compromise.
• Sovereignty: Negligible. No government systems, electoral processes, or sovereign decision-making bodies were targeted or affected.
• Economic security: Minor. An autonomous agent accessed McKinsey's proprietary research database, highlighting potential vulnerabilities in corporate intellectual property, but no actual data theft or economic damage occurred.
• Societal stability: Negligible. No societal stability, human rights violations, or mass surveillance impacts were associated with this corporate security incident.