Vulnerability / research

AI-led testing uncovered a vulnerability in McKinsey's Lilli

Reported

What happened

CodeWall reported that its AI testing agent exploited SQL injection and related access weaknesses in Lilli, McKinsey's internal AI platform.

Parties and reporting

AI tools and systems: Lilli, CodeWall autonomous security agent

Outcome

McKinsey confirmed the vulnerability and said it fixed it within hours. Its investigation found no evidence of unauthorized access to client confidential information.

Operating lesson

Apply standard application security to AI platforms and protect stored system prompts as privileged configuration.

Evidence and limits

Researcher claims about reachable data are not a confirmed client-data breach. McKinsey explicitly reported no evidence that client confidential information was accessed.

Sources