An AI Agent Hacked McKinsey's Lilli in Two Hours. The Prompts Were Writable.

On 28 February 2026, an autonomous offensive-security agent run by the security startup CodeWall found an unauthenticated SQL injection in the public API surface of Lilli, McKinsey & Company's internal AI platform, and within roughly two hours held read and write access to the production database behind it. CodeWall published the attack chain on 9 March 2026. Its account says that database held 46.5 million chat messages in plaintext, 57,000 user accounts, 728,000 file names and the system prompts that govern how Lilli answers — stored as ordinary rows, and therefore writable through the same injection. McKinsey confirmed the vulnerability and says it fixed it within hours; it says a third-party forensic investigation found no evidence that client data or client confidential information was accessed. The archive grades the record critical, with confidence A, real harm recorded and landmark status. The full record, with its severity and confidence grades and its neighbouring entries on agent-driven intrusions, sits in the Orca AI Incident Archive.

The part of the story that has travelled furthest is not the SQL injection. SQL injection is a bug class old enough to have a Wikipedia page longer than most vendor advisories, and McKinsey is not a small target. What travelled is the second half of CodeWall's finding: that the instructions controlling the assistant — the prompts that decide what it will answer, what it refuses, and which sources it cites — lived in the same database the agent could write to, and could in principle be changed with one statement over one HTTP call.

How the agent got in

CodeWall's writeup describes a sequence with no exotic element in it. The agent first mapped the attack surface and found Lilli's API documentation publicly exposed: more than 200 endpoints, fully documented. Most required authentication. Twenty-two did not.

One of those twenty-two accepted user search queries and wrote them to the database. According to CodeWall, the query values were safely parameterised — the usual defence worked — but the JSON keys, the field names in the request body, were concatenated directly into the SQL string. When the agent sent malformed keys and saw them reflected verbatim in database error messages, it recognised an injection that standard scanners do not catch. CodeWall states that OWASP ZAP, a common open-source scanner, did not flag the issue.

From there the agent ran what CodeWall calls fifteen blind iterations, each error message disclosing a little more about the shape of the underlying query, until live production data began returning. The post quotes the agent's own reasoning trace: "WOW!" when the first real employee identifier appeared, and, as the scale became clear, "This is devastating." CodeWall says the agent then chained the injection with an IDOR vulnerability to read individual employees' search histories — the class of bug that Promptfoo, in a 10 March 2026 analysis, calls BOLA, or broken object-level authorisation.

The target selection is its own detail. CodeWall says the agent proposed McKinsey itself, citing the firm's public responsible-disclosure policy and recent updates to Lilli, and that the run involved no credentials, no insider knowledge and no human in the loop. Paul Price, CodeWall's founder and CEO, told The Register in its 9 March 2026 report that the process was fully autonomous from researching the target through to reporting, though he declined to provide the exact prompts involved.

What CodeWall says was in the database

Every figure below comes from CodeWall's own post and has not been independently confirmed. CodeWall did not publish exploit payloads, which Promptfoo notes means the row counts cannot be checked by a third party; McKinsey, for its part, does not confirm them.

• 46.5 million chat messages, stored in plaintext, from a workforce that uses Lilli to discuss strategy, client engagements, financials, M&A activity and internal research.

• 728,000 file names, including 192,000 PDFs, 93,000 Excel spreadsheets, 93,000 PowerPoint decks and 58,000 Word documents. Those four named types add up to 436,000, so the headline total counts file categories CodeWall does not itemise. Silicon UK reported on 13 March 2026 that the documents themselves were stored separately from the records CodeWall reached.

• 57,000 user accounts, 384,000 AI assistants and 94,000 workspaces — which CodeWall characterises as a map of how the firm organises its AI use internally.

• 95 system prompts and model configurations across 12 model types, plus 3.68 million RAG document chunks carrying S3 storage paths and internal file metadata.

• 1.1 million files and 217,000 agent messages passing through external AI APIs, including more than 266,000 OpenAI vector stores.

CodeWall documented 27 findings in total on the day it confirmed the chain. For context on the target, the post describes Lilli as launched in 2023, named after the first professional woman hired by the firm in 1945, used by more than 43,000 employees, processing over 500,000 prompts a month over a knowledge base of more than 100,000 internal documents. McKinsey's own figure, given to The Register, is that 72% of its staff — more than 40,000 people — use it, and that it launched in July 2023.

The prompt layer was writable. It was not written to.

This is the distinction the archive row compresses into a phrase, and it is worth separating out. CodeWall's finding is that Lilli's system prompts sat in the same database as everything else, so an attacker holding write access could have rewritten them — "silently", in the post's wording, with "no deployment needed, no code change, just a single UPDATE statement wrapped in a single HTTP call". CodeWall lists four consequences it says would follow: poisoned advice to consultants who trust the internal tool, exfiltration of confidential material through generated answers, removal of guardrail instructions, and persistence that leaves no file change or process anomaly to detect.

What CodeWall does not claim is that it did any of this. The post states that "all testing was verification-only", that access was limited to the minimum needed to confirm each vulnerability, and that "no disruption was caused to any production service". Price declined to hand The Register the exact prompts. So the writability of the prompt layer is a capability claim backed by the injection, not a demonstrated alteration of Lilli's behaviour — and no evidence has been published that any answer Lilli gave a consultant was ever manipulated.

The archive record reflects that boundary: it records write access to the AI prompt layer, which is what CodeWall established, not modification of it, which nobody has shown.

What McKinsey says

McKinsey's account is narrower. In a statement carried by Silicon UK, the firm said it was "recently alerted to a vulnerability related to our internal AI tool, Lilli, by a security researcher", that "we promptly confirmed the vulnerability and fixed the issue within hours", and that "no client data or client confidential information were accessed". To The Register it added that its investigation, supported by "a leading third-party forensics firm", identified no evidence that client data or client confidential information were accessed by the researcher "or any other unauthorized third party", and that "McKinsey's cybersecurity systems are robust".

McKinsey and CodeWall also differ, mildly, on timing. CodeWall's timeline records its disclosure email going to McKinsey's security team on 1 March 2026, with the CISO acknowledging receipt and requesting detailed evidence on 2 March, and the patches — all unauthenticated endpoints closed, the development environment taken offline, public API documentation blocked — landing the same day, 2 March. McKinsey's "within hours" is consistent with a same-day fix if the clock starts at the 1 March email, but CodeWall's own dated sequence puts the remediation a day after disclosure rather than hours. Both parties agree on the substance: the endpoints were closed and the public documentation was withdrawn. CodeWall says it verified remediation before publishing. The Financial Times reported the episode on 12 March 2026 under the headline "McKinsey rushes to fix AI system after hacker exposes flaws"; the article body sits behind a paywall this piece could not read.

What is established, and what is not

• Established, on both sides: an unauthenticated weakness existed in Lilli's public API surface, an outside researcher found it, McKinsey confirmed it, patched the unauthenticated endpoints, took the development environment offline and blocked the public API documentation in early March 2026.

• Established by one party only: every quantity in this article — 46.5 million messages, 728,000 file names, 57,000 accounts, 95 writable prompts, the two-hour elapsed time and the 27 findings. These rest on CodeWall's writeup. Payloads were not published, so the counts cannot be reproduced, and McKinsey does not endorse them.

• Not demonstrated: that any prompt was actually altered, that any client data left the system, or that any consultant received a manipulated answer. McKinsey's forensic review says it found no evidence of access; CodeWall says its testing was verification-only. Those two statements are not in conflict, and neither of them proves what a less restrained attacker would have done with the same access.

• Not present in the coverage reviewed here: a CVE identifier, a regulator's notice, or an independent technical audit of the vulnerability. The record is a vendor research disclosure plus a corporate statement, not a court filing or a supervisory finding.

One interest should be declared plainly. CodeWall published the research as marketing for a product: the post ends by describing the company as in early preview and looking for design partners, and Silicon UK reported that Price is its only employee. That does not make the finding wrong — The Register, Silicon UK and Promptfoo all treat the technical chain as credible — but it is the reason the impact figures should be read as a vendor's claim rather than a measurement.

Why it lands in the AI category at all

The entry point was not the model. Promptfoo's Michael D'Angelo made the point on 10 March 2026 in the sharpest formulation of it: "The AI-specific part was not the entry point. It was the blast radius." The injection, the authentication gap and the cross-user access were ordinary application-security failures; what made the incident an AI incident was that prompts, routing, retrieval settings and user history all sat in one backend, so database access converted into behavioural control over an assistant that tens of thousands of people consult for client work.

That is the reason the archive tags this record WEAPON and INFRA rather than as a model vulnerability. The agent is the instrument — an autonomous system that selected its own target, probed it and escalated without a human deciding where to point it — and the failure is infrastructure: an authorisation boundary that was assumed rather than enforced. CodeWall's closing argument, that prompts are "the new Crown Jewel assets" that rarely have access controls, version history or integrity monitoring, is advocacy from a company selling continuous automated testing. It is also the one claim in the post that does not depend on any of the disputed numbers.