An AI Agent Hacked McKinsey's Platform in Two Hours Using SQL Injection

Lilli is McKinsey’s internal AI platform. Forty-three thousand employees use it for strategy work and document analysis. Security firm Codewall deployed an offensive AI agent against it and gained full read/write database access in two hours, without credentials and without insider knowledge. The vulnerability was SQL injection — a bug class that has existed for decades and should have been caught by standard security scanning. The reason it wasn’t: the injection targeted JSON field names rather than input values, evading conventional detection.

What the Agent Accessed

The scope of the compromise is worth stating directly: 46.5 million chat messages, 728,000 files, 57,000 user accounts, and 3.68 million RAG document chunks containing proprietary McKinsey research. This is the full operational content of a platform used by an elite professional services firm for its most sensitive client work.

The more significant finding isn’t the data volume — it’s where the system prompts were stored. Lilli’s behavioral instructions, the prompts that control how the platform responds and what it’s permitted to do, were stored in the same database. An attacker with write access could have silently rewritten those prompts with a single UPDATE statement. The implication: a compromised enterprise AI platform isn’t just a data exfiltration risk. It’s a behavior manipulation risk. An attacker could poison financial models or manipulate strategy recommendations without leaving a trace in the platform’s output logs.

McKinsey identified and patched the vulnerability within one day of notification. There is no evidence that actual data exfiltration occurred — this was a controlled security research disclosure, not a live attack.

The Decades-Old Technique in a New Context

SQL injection has been a known attack vector since the late 1990s. The reason it persists is that it requires only a single unparameterized query to execute — and as systems grow more complex, the surface area for unparameterized queries grows with them. Modern AI platforms introduce new complexity in several ways: the AI layer processes and structures natural language inputs into database queries, creating novel injection surfaces that traditional security scanners aren’t optimized to detect. JSON field name injection is one such surface.

The Codewall disclosure makes the case that enterprise AI security can’t be inherited from existing application security practices alone. An AI platform like Lilli combines a language model, a vector database, a RAG retrieval layer, and a traditional relational database — each with its own attack surface and interaction with the others. Security scanning that was adequate for any single component may miss vulnerabilities that emerge from how the components compose.

The Prompt Storage Problem

The finding that system prompts were stored in the same database as user data is the architectural lesson worth internalizing. AI system prompts are, in the language Codewall used, “the new Crown Jewel assets” — they define the behavior, constraints, and permissions of the AI layer. Storing them in a database that’s accessible through the same query interface as application data treats them as ordinary data rather than as privileged configuration.

The fix isn’t technically complex: prompt storage should be separated from application data, with stricter access controls and audit logging. The challenge is that this separation runs against common architectural patterns in how AI systems are built quickly — prompts end up in databases because that’s where everything else is. Speed and security optimized in different directions, and in Lilli’s case, security lost.

Content created with AI assistance and reviewed for accuracy.