自主攻击 agent 约两小时打穿 McKinsey 内部 AI 平台 Lilli：未鉴权端点与字段名 SQL 注入取得生产数据库完整读写，影响规模两说并列。 一句话（英）：An autonomous attack agent breached McKinsey's internal AI platform Lilli in about two hours: unauthenticated endpoints and a field name SQL injection gave full read and write access to the production database; the impact scale remains disputed.An autonomous attack agent breached McKinsey's internal AI platform Lilli in about two hours: unauthenticated endpoints and a field name SQL injection gave full read and write access to the production database; the impact scale remains disputed.

Lilli is McKinsey's internal AI platform, launched in 2023, serving more than 43,000 employees with adoption above 70 percent and more than 500,000 prompts a month (platform background figures per CodeWall's disclosure). On February 28, 2026, security company CodeWall's autonomous offensive agent, working with no credentials, no internal knowledge and no human in the loop, started from Lilli's publicly exposed API documentation and obtained full read and write access to the production database. The attack chain, per CodeWall's disclosure: the API documentation was publicly exposed, listing more than 200 endpoints, 22 of them requiring no authentication; one unauthenticated endpoint wrote user search queries into the database, where the query values were parameterised but the JSON keys (field names) were concatenated directly into the SQL statement; the agent recognised the injection point from key names echoed back in database error messages and, over 15 blind injection iterations, mapped the query structure until production data flowed back; CodeWall states that standard tools such as OWASP ZAP did not detect the issue. The same injection granted both read and write. The agent also chained an IDOR flaw to read one employee's search history. CodeWall disclosed responsibly to McKinsey on March 1; McKinsey fixed all unauthenticated endpoints, took the development environment offline and blocked the public API documentation on March 2 (the fix item marked verified by CodeWall); CodeWall published on March 9.

Impact scope (all figures per CodeWall's disclosure, one party's account, not independently confirmed, attribution required when cited): 46.5 million chat messages, 728,000 file records, 57,000 user accounts, 384,000 AI assistants, 94,000 workspaces, 3.68 million RAG document chunks, 1.1 million files passed through external AI APIs and 217,000 agent messages, plus 95 system prompt and model configuration items stored in the same database as production data, across 12 model types. CodeWall states that a holder of the write access could have rewritten system prompts with a single UPDATE statement, with no deployment and no code change; its wording is that this could have been done, and it does not claim to have done it. CodeWall describes all of its testing as verification access, limited to the minimum needed to confirm each flaw, with no production outage.

The dispute, carried side by side: McKinsey's statement of March 11, 2026 (core sentence matching its March 9 statement to The Register) says its investigation, supported by a leading third party forensics firm, identified no evidence that client data or client confidential information were accessed by this researcher or any other unauthorised third party. Separately, the Financial Times, citing a McKinsey source via The Register, reported that the underlying files were stored separately and were never at risk, which conflicts with CodeWall's file record account. Analyst Edward Kiledjian, quoted by The Register, called CodeWall's attack chain credible and technically sound but its claimed impact scope insufficiently proven; Promptfoo's analysis likewise notes that the exact payloads are unpublished and the public record cannot independently prove every row count and exploitation step. This entry adjudicates none of the three accounts: scale figures are recorded as reachable scope with attribution, and the gap between "reachable" and "actually taken" cannot be closed from public material; that limit stays with the entry.

First, this is an agent on both sides event. On the attack side, an agent chose its own targets, enumerated on its own and chained flaws at machine speed with no human in the loop. On the defence side, what was breached was not an ordinary business system but the company's own AI platform, which aggregates every employee's conversations, the knowledge base and the instruction configuration, so the blast radius of a single failure is set by the platform's degree of aggregation. Second, the failure is unrelated to the model and related to architectural coupling: the injection point is the most traditional flaw class, the platform had been running in production for over two years and their own scanners failed to find the injection (per CodeWall); what amplified the consequences is the coupling, conversation data, the RAG knowledge base and system prompts in one database under one permission set, so one breach at the access layer surrendered the data layer and the instruction layer together. Third, the prompt layer is this entry's most archivable point: when system prompts are stored as mutable application data alongside business data, they inherit database row permissions instead of the change control that behavioural authority should carry; editing one record silently changes the answers and guardrails of an AI used by tens of thousands of employees, with no deployment record. Where prompts live, who can write them and how their integrity is monitored should be governed as behavioural control assets, not configuration data. Fourth, the response is a positive sample on the reconciliation ledger and the attribution is a gap sample: McKinsey completed its fix the day after disclosure and published a statement within ten days, a short distance between announcement and landing; but impact is reported by the discloser as reachable scope and by the operator as zero on forensic findings, with no shared standard for deciding between the two, and that missing standard for impact determination in enterprise AI platform incidents is itself an entry on the governance ledger. Controls (compiled by DeepWing on framework lines, not the parties' wording): preventive, authenticate production endpoints by default and register every unauthenticated endpoint with its justification, never expose the production interface inventory in public API documentation, validate SQL field names as strictly as values, store system prompts outside the business database with separate write permission and approval; detective, alert on enumeration style reads against production databases and keep integrity monitoring with change trails on prompt configuration; recovery, see McKinsey's fix actions in the facts section.

Preventive controls：authenticate production endpoints by default and register every unauthenticated endpoint with its justification; never expose the production interface inventory in public API documentation; validate SQL field names as strictly as values; store system prompts outside the business database with separate write permission and approval.

Detective controls：alert on enumeration style reads against production databases; keep integrity monitoring with change trails on prompt configuration.

Recovery controls：see McKinsey's fix actions in the facts: endpoints fixed, development environment offline and public documentation blocked the day after disclosure.