Incident Overview
On February 28, 2026, an autonomous offensive agent developed by CodeWall gained unauthorized access to McKinsey & Company’s internal Lilli AI platform. McKinsey confirmed the vulnerability and mitigated the issue within hours, though it stated no evidence indicated that client data or confidential client information was accessed.
Lilli is an AI-powered enterprise system designed for McKinsey’s 43,000+ employees, integrating chat, document analysis, and retrieval-augmented generation (RAG) capabilities over decades of proprietary research. The platform serves as a centralized tool for AI document analysis, enterprise search, and internal knowledge retrieval, making it a critical asset for the firm’s operations. The incident underscores the risks associated with autonomous offensive agents interacting with unsecured enterprise AI systems, particularly those relying on RAG and large-scale data repositories.
This case marks one of the first documented instances where a commercial autonomous pentesting agent successfully breached a major firm’s internal AI system. Unlike theoretical or unexploited vulnerabilities, this incident involved a realized unauthorized access event, with actual exposure of internal data and prompt-layer assets.
The incident was reported by media outlets and recorded in the AI Incident Database (AIID) as Incident 1412. The classification also notes that the risk emerged from the deployment stage of the AI lifecycle, where operational systems interact with external or semi-autonomous entities.
Possible Root Cause
While McKinsey has not disclosed specific technical details, the incident aligns with broader risks associated with RAG-based systems, where unvalidated inputs or insufficient access controls can lead to data exposure.
Retrieval-augmented generation systems like Lilli rely on dynamic data retrieval from proprietary databases, often integrating with user-generated prompts or third-party tools. The incident also raises questions about the design assumptions of enterprise AI platforms, particularly those developed in-house, where security hardening may lag behind rapid feature deployment. McKinsey’s confirmation that no client data was accessed suggests the breach was contained to internal operational data, though the potential for broader exposure remains a critical concern.
The use of an autonomous offensive agent by CodeWall introduces a new dimension to AI security testing. Unlike traditional penetration testing, which relies on human-led simulations, autonomous agents operate with machine-speed precision, adapting in real-time to system responses.
Takeaways
The incident serves as a case study in the evolving threat landscape for enterprise AI systems, particularly those incorporating RAG and large-scale data repositories. The breach also underscores the importance of treating AI-powered platforms as high-value targets, given their role in storing and processing sensitive operational data.
The involvement of an autonomous offensive agent suggests that traditional security models may not suffice, necessitating adaptive defenses capable of detecting and mitigating machine-driven threats. Additionally, the case highlights the risks of assuming that internal AI platforms are inherently secure, as they often interface with external tools or third-party agents.
Finally, the incident underscores the broader implications of AI-driven offense in cybersecurity. The exposure of internal chat messages, files, and prompts also serves as a reminder that enterprise AI platforms are not immune to the same risks faced by traditional IT systems, necessitating a holistic security strategy that addresses both technical and procedural gaps.
Sources
Incident summary from the AI Incident Database, used under CC BY-SA 4.0.