A red-team security startup has demonstrated how an autonomous AI agent can breach an enterprise AI platform in under two hours, raising new alarms about the vulnerability of corporate AI deployments to machine-speed attacks.
CodeWall, which provides continuous offensive security testing using AI agents, turned its autonomous agent against McKinsey's internal generative AI platform, called Lilli, in late February 2026. The agent operated without access to any credentials for McKinsey's systems.
Within two hours, the agent had gained full read and write access to Lilli's production database. The exposure included 46.5 million chat messages covering strategy, mergers and acquisitions, and client engagements, all stored in plaintext. The agent also reached 728,000 files containing confidential client data, 57,000 user accounts, and 95 system prompts governing the AI's behavior. Those prompts were writable -- meaning an attacker could alter what Lilli tells McKinsey's tens of thousands of consultants.
McKinsey launched Lilli in July 2023. The platform is now used by roughly 72 percent of the firm's workforce, upwards of 40,000 people, processing more than 500,000 prompts per month. CodeWall's agent identified the target itself, citing McKinsey's public responsible disclosure policy and recent updates to the platform.
The vulnerability was a SQL injection flaw. CodeWall disclosed the full attack chain to McKinsey on March 1. Within 24 hours, McKinsey had patched all unauthenticated endpoints, taken its development environment offline, and blocked public API documentation.
McKinsey stated that a third-party forensics firm found no evidence that client data was accessed by CodeWall or any other unauthorized party. "McKinsey's cybersecurity systems are robust, and we have no higher priority than the protection of client data," a company spokesperson said.
CodeWall CEO Paul Price declined to disclose the specific prompts used in the attack. The company's methodology illustrates a growing category of risk: agentic AI systems attacking other agentic AI systems at speeds that human security teams cannot match in real time.
The incident points to a structural gap in how many enterprises have deployed internal AI platforms. Systems like Lilli aggregate sensitive organizational knowledge and expose it through natural-language interfaces, creating high-value targets. Traditional application security practices, including input validation and authentication hardening, remain essential but are increasingly being tested by automated offensive tools that can probe thousands of potential vulnerabilities in parallel.
Security researchers have warned for months that the rapid deployment of enterprise AI chatbots has outpaced security review cycles. This case represents a concrete, documented example of what that gap looks like in practice.
Sources: The Register, CodeWall
–
By the Control Plane Editorial Team