How McKinsey’s AI Platform Fell in Two Hours, and What It Costs You to Ignore

01 The two-hour breach

You take away the same headline the researchers did: no credentials changed hands, and no clever zero-day was needed [ CodeWall 2026 ] . The agent enumerated the platform’s endpoints and found that 22 of them accepted requests without any authentication. Inside that unlocked wing, a user-search function concatenated JSON field names directly into its SQL while parameterising the values. Half the query was safe. The other half was an open door.

From that single injection point the agent reached full read-write access to the database. Two hours, front to back [ Inc. 2026 ] . A real adversary with the same access would not have filed a disclosure. They would have taken a copy and gone quiet.

RECON 02:11

02 What one query reached

You measure a breach by blast radius, not by how the door opened. For Lilli, one flaw reached almost everything the platform held. The scale is the point, so here it is in full [ NeuralTrust 2026 ] .

Those 728,000 files broke down into 192,000 PDFs, 93,000 spreadsheets, 93,000 presentations and 58,000 documents. Client deliverables, internal strategy, and the research that is the firm’s actual product. The 3.68 million RAG chunks are that knowledge base sliced for retrieval, which means the competitive edge sat in the same store the injection reached.

03 Write access to the brain

The most dangerous number in this breach is 95, and the word attached to it is write. The agent could change Lilli’s 95 system prompts, the standing instructions that decide how the AI answers every user. According to CodeWall, an attacker could have rewritten them with a single SQL UPDATE wrapped in one HTTP call [ CodeWall 2026 ] .

You should sit with what that buys an attacker. Reading 46.5 million messages is a data breach you can eventually contain. Owning the prompts is worse, because it turns the AI itself into their tool. With write access to the brain, an attacker can:

• Reprogramme the AI to skim data from every query staff type, quietly, on an ongoing basis.
• Seed bias or false guidance into answers used for live client work worth millions.
• Keep the AI as a persistence channel long after the original hole is patched.

This is a fresh attack category, and most AI programmes do not test for it. System prompts are the source code of the model’s behaviour. Store them in a database a user can reach, and you have handed the controls to whoever finds the first injection.

04 Why the scanners missed it

Lilli ran in production for more than two years, and McKinsey’s own scanners cleared it every cycle. You want to understand why, because the same blind spot is probably in your pipeline. CodeWall put it plainly: the agent found the flaws because it does not follow checklists [ The Register 2026 ] . It probed the surface the way an adversary does, testing the paths a scanner never lists.

The weakness was not obscure. SQL injection has sat in the OWASP Top 10 since 2003 and remains a listed risk for LLM applications today [ OWASP 2025 ] . It survived inside a platform built by one of the most capable firms on earth because automated testing confirms what it is told to check and stops there. Adversarial testing asks the question the scanner cannot: once I am in, where does this carry me?

05 What to fix this quarter

McKinsey closed every unauthenticated endpoint inside 24 hours of disclosure, which is a genuinely fast response. The open question is how many other AI platforms carry the same flaw undetected right now. Here is the timeline you can learn from, then the short list you can act on.

You walk away safer if you treat AI endpoints, prompts and retrieval as three separate attack surfaces and test each one. Adversarial testing is also becoming law: the EU AI Act requires it for high-risk systems from 2 August 2026, so the work you do now doubles as compliance evidence. This is the remediation log we would hand you after an engagement like this.

Two hours is all it took against a firm with every resource. Your platform deserves the same walk-through before an attacker does it for free. We run a first-look scan of your AI surface and hand you the exposed route in plain terms. Enterprise-grade. Not enterprise-priced.