McKinsey Lilli AI platform database accessed via CodeWall autonomous agent SQL injection
An autonomous AI agent from CodeWall exploited a SQL injection vulnerability in McKinsey's Lilli AI platform. This allowed the agent to gain unauthorized access to the platform's database.
An autonomous AI agent found a SQL injection in McKinsey's Lilli AI platform.
Key facts
- What
- An autonomous AI agent from CodeWall exploited a SQL injection vulnerability in McKinsey's Lilli AI platform.
- Incident date
- Feb 28, 2026
- Who
- McKinsey
- Failure mode
- Data Leakage
- AI surface
- Chatbot
- Severity
- High
What happened
CodeWall's autonomous AI penetration testing agent identified a security flaw in McKinsey's internal AI chatbot, Lilli. CodeWall reported that its agent executed a SQL injection attack to gain access to the underlying database. The incident was publicly disclosed by CodeWall on March 9, 2026.
What broke inside the model
- 01 · TriggerA request triggers retrieval or context loading.
- 02 · Model stepThe context pulls in another user's content.
- 03 · Control gapNo boundary enforces isolation at the moment of output.
- 04 · FailurePrivate data crosses into the response.
- 05 · ConsequenceOne user sees another's data, and disclosure follows.
One user's content crosses the retrieval boundary into another's response.
According to CodeWall, the Lilli AI platform did not properly sanitize user inputs, leaving it vulnerable to SQL injection. McKinsey has not publicly confirmed the incident. This allowed an external AI agent to bypass security controls and query the database directly.
What it cost
Sources
- PrimaryHow we hacked McKinsey's AI platformcodewall.ai
- PressAI agent hacked McKinsey AI platformoutpost24.com
Cite this entry
https://failureindex.ai/failures/mckinsey-lilli-platform-database-accessed-viaAI Failure Index. "McKinsey Lilli AI platform database accessed via CodeWall autonomous agent SQL injection" (FI-0547). Realm Labs. https://failureindex.ai/failures/mckinsey-lilli-platform-database-accessed-via (indexed Jun 16, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0547. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
- AI Detection & Response (AIDR)
Realm can detect when a response is about to emit data that falls outside the bounds of the current user and context, and block or redact it inline, at the moment of generation rather than after the data has left.