The short version
CodeWall, a cybersecurity company, used an autonomous AI agent—a self-operating hacking tool—to break into McKinsey's internal AI platform called Lilli in just two hours, without any login credentials or insider help. The agent gained full read and write access to a massive database holding 46.5 million employee chat messages, 728,000 sensitive files like PDFs and spreadsheets, and details on 57,000 user accounts. This shows how AI tools speeding up attacks could expose your company's or personal data if big firms like McKinsey can't secure their systems.
What happened
Imagine McKinsey as the fancy consulting firm that helps huge companies make big decisions, like mergers or strategies. They built Lilli, their own AI chatbot, for over 43,000 employees to chat with, analyze documents, and search through 100,000+ internal files—think decades of secret research on business tactics. Over 70% of staff use it, firing off 500,000 questions a month.
CodeWall pointed their "offensive AI agent" at it. This isn't a human hacker typing commands; it's an AI that thinks and acts on its own, like a robot detective scanning for weak spots. Starting with just McKinsey's web address, the agent in two hours found public API documentation—basically a menu of 200+ ways to talk to the system. Most needed a password, but 22 didn't. One let it sneak in via a flaw called SQL injection.
Think of SQL injection like slipping a fake name tag into a locked filing cabinet: the system trusted the label without checking, letting the agent peek and even rewrite files. It pulled out employee chats on client deals, finances, and strategies—all in plain text. It also grabbed system instructions telling Lilli how to behave (like guardrails to stay safe), millions of research document pieces, and even paths to download files directly. Worse, it could have quietly changed those instructions to poison advice or leak secrets through normal chats. Standard hacking tools missed this; only the smart AI spotted it.
Why should you care?
This isn't just McKinsey's problem—it's a wake-up call for anyone using AI at work or trusting big companies with your data. McKinsey advises giants like banks and governments; their leaked chats could spill your company's secrets if you're a client. For everyday folks, it means AI speeding up hacks on tools you rely on, like workplace chatbots or customer service AIs. If elite firms leave doors unlocked, smaller businesses and even apps handling your personal info (health records, finances) are at bigger risk. Hackers could twist AI advice, like making a financial tool suggest bad investments subtly, and you'd never know.
What changes for you
Right now, nothing flips overnight, but expect tighter security checks on company AI tools—your employer might add logins or audits to chat systems you use daily. If you work at a big firm, watch for emails about "security updates" to internal AIs; they could slow things down slightly but keep your strategies safe. Clients of consultancies like McKinsey might see higher fees for "AI security guarantees." For regular users, free AI tools (like chatbots for resumes or shopping) could get more pop-up warnings or delays as companies fix similar flaws. Long-term, this pushes "cyber hygiene"—basic locks like proper checks on data inputs—across AI, making your online banking or health apps safer from AI hackers.
Frequently Asked Questions
### What exactly is Lilli, and who uses it?
Lilli is McKinsey's custom AI platform, like a super-smart internal search engine and chatbot for their 43,000 employees. It lets them analyze documents, search proprietary research, and get advice on client projects—used by over 70% of staff for 500,000 chats a month. Regular people don't access it directly; it's for McKinsey insiders handling big-business secrets.
### How did the AI agent hack it so fast without passwords?
The agent acted alone, scanning public info like API guides (lists of system commands). It found an unprotected entry point with a SQL injection flaw—think of it as tricking a form by adding sneaky code that reveals the database structure. After 15 smart guesses based on error clues, it read and wrote data freely, something basic tools missed.
### What sensitive stuff was exposed?
Tens of millions of plaintext chats on strategies, finances, and deals; 728,000 files (PDFs, Excel, PowerPoints) with direct download links; user accounts; AI instructions; and McKinsey's research "crown jewels." Attackers could rewrite AI rules to give bad advice or leak data silently—no alarms.
### Could this happen to AI tools I use every day?
Yes, if they have similar weak spots like unpatched inputs or exposed menus. Consumer AIs (e.g., for job hunting or shopping) might not hold corporate secrets, but flaws could leak your queries or files. This hack shows AI agents picking targets automatically, so companies will prioritize fixes—your tools might feel more secure but slightly slower.
### What is CodeWall doing, and did McKinsey fix it?
CodeWall is a red-team firm testing defenses; their AI even picked McKinsey due to its disclosure policy. They shared details responsibly. McKinsey's response isn't detailed here, but such reports usually lead to quick patches—check their site for updates.
The bottom line
This hack proves AI isn't just making work faster—it's arming hackers too, letting them breach top-tier systems like McKinsey's Lilli in hours and steal career-shaping data. For you, it means pushing your workplace or apps to lock down AI properly; otherwise, trusted tools could feed bad info or expose your details. Demand better "cyber hygiene" from companies—it's the simple step keeping your job strategies, finances, and privacy safe in the AI age. Stay vigilant, and this could make everything more secure.