How McKinsey's AI platform was breached in under two hours, and what would have stopped it

An autonomous agent found 22 unauthenticated endpoints and read 46.5M messages out of Lilli. Every failure maps to a governance stage that was simply not there.

In late February 2026, an autonomous offensive-security agent operated by CodeWall was pointed at Lilli, the internal generative-AI platform McKinsey built for its own consultants. In under two hours, with no insider knowledge, it went from a public API documentation page to full read and write access to the production database behind the platform. The disclosure that followed described 46.5 million chat messages, millions of document chunks, and tens of thousands of user accounts sitting behind endpoints that asked for no authentication at all.

The detail that matters is not the size of the number. It is that the attacker was itself an AI agent, that it needed nobody on the inside, and that nothing in the platform noticed it working. This is not a trading-floor story or a careless-intern story. It is the shape of the risk every organization now runs the moment it puts an agent in front of real data.

The firm the rest of the world hires to advise on risk had, on its own AI platform, no agent identity, no authorization on 22 endpoints, and no way to tell that an attacker had been iterating against it for two hours.

What actually happened

Lilli exposed an API surface of more than two hundred endpoints, and its documentation for them was publicly reachable. Twenty-two of those endpoints required no authentication whatsoever. One of them accepted search queries, and the way it built its database query was the classic mistake: the values a caller sent were handled safely, but the JSON field names in the request were concatenated straight into SQL. Error responses reflected those field names back, which is the tell that tells an attacker the injection is live.

From there it was iteration. Over roughly fifteen refinements the autonomous agent adjusted its payloads against the error messages until production data flowed, and then kept going until it had read access and, worse, write access. Among the things it could reach were the ninety-five system prompts that defined how the platform behaved, stored writable in the same database as the user data. An attacker with that access could silently rewrite what tens of thousands of consultants were told by their AI, without ever deploying a line of code.

What McKinsey did not have

• No agent identity. Nothing established who or what was making the requests, so an autonomous attacker looked exactly like ordinary traffic.
• No authorization on 22 endpoints. Reaching data required nothing more than knowing the URL, and the URLs were documented in public.
• No behavioral detection. Fifteen iterative injections against the same surface in a short window produced no alert, because nothing was watching for the pattern.
• No content scanning. The SQL injection rode in on the request and was never inspected; the error messages that leaked the schema were never scrubbed.
• No tamper-evident audit trail. After the fact, McKinsey had to bring in an outside forensics firm to reconstruct what had happened, because the platform could not.
• No kill switch. The attack ran for more than two hours with nothing able to halt it.

How Agentomy governs this attack

Every one of those failures is a stage in the governance pipeline Agentomy puts in front of an agent, and the incident is a near-perfect walk through them. An unidentified caller is stopped at identity resolution before it reaches anything. An unauthenticated request to a governed action is refused at tier-based authorization rather than served. The fifteen iterative probes are exactly the shape behavioral baselining is built to catch, with deviation flagged long before the fifteenth attempt. The injection itself is caught by content scanning on the way in, and the schema-leaking error is scrubbed on the way out. Every decision lands in a hash-chained audit trail that reconstructs the sequence without a forensics contract. And a fleet-wide halt stops the actor in well under a second rather than in two hours.

This is not a hypothetical mapping. The attack sequence is reproduced as a set of governance benchmark scenarios in GovernanceBench, so the claim that these controls would have contained it is something you can run rather than something you have to take on faith. The writable-system-prompt finding, the most quietly dangerous part of the breach, is the case for treating configuration change as a governed, monitored event rather than a database write like any other.

The governance takeaway

A capable autonomous agent reached a global firm's most sensitive data in under two hours, and the platform's own account of the incident is a list of controls that were not present. None of them are exotic. Agent identity, authorization on every endpoint, behavioral baselines, content scanning in both directions, a tamper-evident trail, and a kill switch that survives a restart are the ordinary parts of governing an automated actor. The lesson of Lilli is the same as the lesson of every fast-actor failure before it: you decide how you will stop an agent before you let it run, not after you read the disclosure.