Security startup CodeWall reported that an autonomous AI agent gained read and write access to the production database behind McKinsey & Company's internal generative AI platform, Lilli, within two hours. The Register reported the findings on March 9, 2026, the day CodeWall published its account.
Lilli launched inside McKinsey in July 2023. According to the report, about 72 percent of the firm's employees, roughly 40,000 people, use the platform, which processes more than 500,000 prompts per month.
CodeWall said its agent found 22 publicly exposed API endpoints that required no authentication. One endpoint wrote user search queries to the database and joined JSON keys into SQL statements, which created a SQL injection flaw. CodeWall stated the agent received no credentials and selected McKinsey as its target on its own, citing the firm's public responsible disclosure policy and recent Lilli updates.
CodeWall claimed the access covered 46.5 million chat messages stored in plaintext, 728,000 files containing confidential client data, 57,000 user accounts, and 95 system prompts that were all writable. Because the system prompts sat in the same database, the read and write flaw would have let an attacker alter them.
By CodeWall's timeline, the agent found the flaw at the end of February 2026 and the full attack chain was disclosed on March 1. McKinsey patched the unauthenticated endpoints the next day, took its development environment offline, and blocked public API documentation.
McKinsey stated that it fixed all issues CodeWall identified within hours of learning of them. According to the company, a third-party forensics investigation identified no evidence that client data or client confidential information was accessed by the researcher or any other unauthorized third party. CodeWall CEO Paul Price said attackers could apply the same techniques for financial blackmail or ransomware.
Source: The Register - https://www.theregister.com/2026/03/09/mckinsey_ai_chatbot_hacked