AI Agent Intrusion: McKinsey's Lilli Platform

On February 28, 2026, an autonomous offensive agent built by the security startup CodeWall reached full read and write access to the production database behind Lilli, McKinsey’s internal AI platform, within about two hours. The researchers say the database held 46.5 million chat messages and 57,000 user accounts (CodeWall). McKinsey patched the flaws the day after disclosure and told The Register that forensics found no evidence client data was accessed by the researcher or anyone else.

What happened

CodeWall ran the test as research under McKinsey’s public disclosure policy, and its own agent suggested the target. The agent started with only a domain name, no credentials, and no human directing it.

It found public API documentation listing more than 200 endpoints, 22 of which required no authentication. One of them wrote user search queries to the database and concatenated the JSON field names directly into SQL. The agent noticed those names echoed in database error messages and ran 15 blind iterations until production data came back. It then chained an IDOR flaw to read individual employees’ search histories. The researchers report reach into 728,000 files, 3.68 million retrieval chunks, and 95 model configurations, including writable system prompts.

How it could have been caught

A search-logging endpoint has a narrow, repetitive job: it receives a query and inserts one row. When the same service starts returning database errors to an anonymous caller, then streams large result sets back to that caller, its behavior has changed in ways a baseline of the production environment would record. The first flag is the burst of errors from an endpoint that had only ever written, followed within the hour by read volume that endpoint had never produced.

What this looks like in Trace

Here is the intrusion path traced inside McKinsey’s cloud. The endpoint behavior, iteration count, and data types come from CodeWall’s write-up; workload names, ports, and timings are illustrative.

Network trace. Workload lilli/search-api. Each row is a behavior Trace’s sensor recorded, checked against the baseline.

The 15 probing requests and the later reads collapse into one case, since they share a workload, a client, and an endpoint.

AI proxy. The attacking agent’s model ran in CodeWall’s infrastructure, so its reasoning never crossed McKinsey’s network. Lilli’s own model calls would cross the proxy, so a rewritten system prompt would appear as a new request pattern for every user.

Traceback. At T+0:42 the triage agent opens a case and follows the chain:

bulk egress from lilli/search-api → unauthenticated request to search-log endpoint → no session, no deploy, no commit, no ticket

The chain ends at an anonymous request with nothing behind it, and that gap is the finding.

Verdict: an outside intrusion through a public endpoint. The case goes to McKinsey’s security team with the error burst, the new read pattern, and the client address attached, about 40 minutes after the first probe and well inside the two hours CodeWall reported.

This analysis reconstructs the incident from public reporting and walks through where Trace would have raised the first alert inside McKinsey’s cloud. Detection times are illustrative.