Disclosed vulnerability
An autonomous pentest agent selected McKinsey's Lilli AI platform as a target and gained read/write production access
AIR-2026-0065 AIR record · 2026-02-codewall-agent-mckinsey-lilli
From the supporting source
As part of our research preview, the CodeWall research agent autonomously suggested McKinsey as a target citing their public responsible diclosure policy (to keep within guardrails) and recent updates to their Lilli platform.codewall.ai
The record
Disclosed
2026-03-09
Occurred
2026-02-28
Vendor
McKinsey & Company
Product
McKinsey Lilli
Risk domain
Privacy › Sensitive data exposure
System type
Generative model
Who acted
Agent acted — the pentest agent chose the target and gained read/write production access
Attack surface
Enterprise assistant
Autonomy level
Fully autonomous
Initial vector
Autonomous vulnerability discovery
Impact type
Data exposure, System prompt exposure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
3.68 million RAG document chunks, internal chat messages, user accounts and system prompts for a 43,000-employee platform
Capability abused
Defense & remediation
Recorded defense
McKinsey platform access controls
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
McKinsey confirmed and fixed the vulnerability within hours
Taxonomy & references
Curator notes
AI Incident Database incident 1412. Two agentic angles at once: an autonomous agent chose and attacked a target, and the victim was itself an enterprise AI assistant. McKinsey says no client data was accessed. Vendor-published research, so treat scope claims with the usual caution.
Supporting sources
Cite as
Enkrypt AI. "An autonomous pentest agent selected McKinsey's Lilli AI platform as a target and gained read/write production access". AIR, AIR-2026-0065. https://agentincident.vercel.app/i/AIR-2026-0065/ (accessed 2026-10-19).