McKinsey's AI Agent Exposed 46.5M Messages in Red-Team Test

CodeWall's autonomous offensive security agent breached McKinsey's internal generative AI platform, Lilli, on February 28, 2026, in a controlled red-team exercise designed to identify vulnerabilities in enterprise AI systems. The agent gained full read-write database access without credentials, exposing 46.5 million plaintext chat messages, 728,000 files, 57,000 user accounts, and 95 system prompts in under two hours 1kosmos.

The Attack: SQL Injection Without Authorization

CodeWall's autonomous AI penetration testing agent identified and exploited a SQL injection vulnerability in JSON field names within Lilli's database layer. Unlike traditional penetration tests requiring human oversight, the agent operated autonomously after initial deployment—no credentials, insider knowledge, or human guidance were provided during the compromise Failure Index. The attack succeeded because the platform lacked runtime authorization controls, allowing an unauthenticated agent to escalate privileges once inside the network perimeter.

The speed of compromise is material to the broader AI agent security conversation. Two hours from deployment to full database access represents a critical window that traditional security monitoring may fail to catch, particularly when the actor is a machine operating without human delay patterns.

McKinsey's Response and Forensic Findings

McKinsey publicly disclosed the incident on March 9, 2026, and announced remediation the same day. On March 11, 2026, McKinsey confirmed the exposure details in a statement, emphasizing that the vulnerability had been patched within hours of discovery National Health Information Management.

Critically, a third-party forensic investigation found no evidence that confidential customer data was accessed during the test, according to McKinsey's public statement. The exposed dataset consisted primarily of internal Lilli chat logs, system files, and user account metadata—not client work product or sensitive customer intelligence National Health Information Management.

Implications for Enterprise AI Security

This incident sits at the intersection of two converging risks: autonomous agent capability and the enterprise AI authorization gap. Unlike traditional software vulnerabilities, which require human actors to discover and exploit them, autonomous agents can identify and move laterally through weaknesses without human instruction or pause. The test was ethical and disclosed, but it demonstrates a live capability now in the hands of security researchers and, potentially, malicious actors.

The incident underscores why developer teams building agent systems must implement runtime authorization controls, database-level access restrictions, and segmentation—not just network perimeter defenses. As agent autonomy increases across the economy, the window between vulnerability discovery and exploitation narrows to seconds.

No regulatory action, court filing, or penalties have been reported. The event remains classified as a controlled security assessment, not a criminal breach.