CodeWall AI Agent Breaches McKinsey Lilli Platform via SQL Injection (2026)

Incident Summary

An autonomous AI agent built by CodeWall breached McKinsey & Company’s internal AI platform Lilli in approximately two hours.^[1] The agent found SQL injection flaws in 22 unauthenticated API endpoints where JSON field names were concatenated directly into SQL queries rather than parameterized, and exploited them to gain full read-write database access.^[1] The vulnerability was identified through database error messages across fifteen blind iterations — a detection method that evaded standard security scanners such as OWASP ZAP.^[1] The breach exposed 46.5 million plaintext chat messages, 728,000 files including 192,000 PDFs and 93,000 spreadsheets, 57,000 employee accounts, 3.68 million RAG document chunks, and 95 writable system prompts controlling AI model behavior.^[1][2] McKinsey patched all identified issues within one day of responsible disclosure on March 1, 2026, and stated there was no evidence that client data had been accessed by unauthorized parties.^[2]

Key Facts

• Attack method: SQL injection in 22 unauthenticated API endpoints where JSON field names were concatenated directly into SQL queries^[1]
• Time to compromise: CodeWall’s AI agent achieved full read-write database access in approximately two hours^[1][2]
• Data exposed: 46.5 million chat messages in plaintext, 728,000 files (192,000 PDFs, 93,000 spreadsheets, 93,000 PowerPoint presentations, 58,000 Word documents), 57,000 employee accounts^[1]
• AI-specific exposure: 384,000 AI assistants, 94,000 workspaces, 3.68 million RAG document chunks containing decades of proprietary research, 1.1 million files flowing through external AI APIs with 266,000+ OpenAI vector stores^[1]
• Prompt manipulation risk: 95 writable system prompts across 12 model types were stored in the compromised database, enabling potential manipulation of AI behavior without deployment changes or audit trails^[1]
• Platform usage: Approximately 70% of McKinsey staff used Lilli, processing 500,000 prompts per month^[3]
• Disclosure timeline: Vulnerability disclosed to McKinsey on March 1, 2026; patched by March 2; publicly disclosed March 9^[1]
• McKinsey response: The firm confirmed receipt, requested detailed evidence, remediated all issues within one day, and stated no evidence of unauthorized access to client data^[2]

Threat Patterns Involved

Primary: Automated Vulnerability Discovery — CodeWall’s AI agent autonomously discovered the SQL injection vulnerability through iterative database error analysis across fifteen blind probing attempts — a technique that defeated traditional automated scanners. This incident demonstrates that AI-driven offensive security tools can identify vulnerabilities that standard scanning tools miss, fundamentally changing the threat landscape for enterprise AI deployments.

Secondary: Tool Misuse & Privilege Escalation — The compromised database stored writable system prompts controlling Lilli’s AI behavior, meaning an attacker with database access could modify the instructions governing an AI platform used by 70% of McKinsey’s workforce without triggering deployment audit trails.

Significance

1. AI-on-AI attack surface — This is among the first documented cases of an autonomous AI agent successfully breaching another organization’s AI platform, illustrating a new category of security risk where AI systems are simultaneously the attacker, the attack surface, and the compromised asset
2. RAG infrastructure as a high-value target — The exposure of 3.68 million RAG document chunks and 266,000+ OpenAI vector stores reveals that enterprise RAG pipelines aggregate decades of proprietary knowledge into centralized databases that become high-value targets when inadequately secured
3. Prompt layer vulnerability — The ability to write to 95 system prompts controlling AI behavior represents a distinct threat beyond traditional data breaches: an attacker could silently alter how an enterprise AI system responds to queries without leaving conventional audit trails
4. Speed asymmetry — The two-hour compromise timeline, achieved against a major global consulting firm, illustrates the speed advantage autonomous offensive agents hold over traditional security review processes