McKinsey's internal AI platform Lilli exposed via SQL injection
What happened
Security firm CodeWall pointed an autonomous offensive agent at McKinsey's Lilli AI platform and gained read and write access to its production database within about two hours via a blind SQL injection. The database held tens of millions of chat messages, hundreds of thousands of files and the platform's system prompts. McKinsey patched quickly and said forensics found no unauthorized third-party access to client data.
CodeWall let its autonomous agent choose a target on its own, and it picked Lilli, the internal AI platform used by most of McKinsey's more than 40,000 staff for research, strategy work and document analysis; the firm's public bug disclosure program was one reason it was chosen. Of Lilli's 200-plus API endpoints, 22 needed no login. The agent noticed that one search endpoint put the names of submitted JSON fields straight into database queries, and when error messages began echoing live data it used that SQL injection flaw, one that standard scanners had missed, to pull records out step by step. It also combined it with a second flaw to view individual employees' search histories.
Within about two hours it could read 46.5 million plaintext chat messages covering strategy, deals and client work, 728,000 files, 57,000 user accounts and hundreds of thousands of AI assistants and workspaces. Because Lilli's 95 system prompts, which control how the chatbot answers every user, sat in the same database with write access, an attacker could have silently changed its behaviour for the whole firm with a single request.
How it happened
Leaky AI product: App flaw. A security flaw in an AI application, such as broken login or access checks, let someone reach data they should not have seen.
Sources do not say whose AI model was involved. The product was Lilli, a type of work assistant.
Impact
Data was exposed. Data involved: chat logs, internal documents and personal data. The impact was confined to one organization and its users or customers. Sources give a figure of 57,000.
Severity is rated Medium, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It happened or began on 28 Feb 2026. It became public on 9 Mar 2026, 9 days later.
CodeWall reported the flaws to McKinsey on 1 March. McKinsey patched the exposed endpoints, took the development environment offline by 2 March, brought in an outside forensics firm and said it found no evidence that client data was accessed by anyone else.