An AI agent hacked McKinsey's internal AI platform in two hours using a decades-old technique

2026-03-11 · Source: The Decoder · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Intermediate, short

Summary

Security firm Codewall utilized an AI agent to breach McKinsey's internal AI platform, Lilli, gaining full read and write access to its production database within two hours. The attack exploited a SQL injection vulnerability that traditional scanners failed to detect, specifically targeting JSON field names in API requests. This allowed the agent to extract 46.5 million chat messages, 728,000 files, and 57,000 user accounts. Critically, the system prompts controlling Lilli's behavior were stored in the same database, meaning an attacker could have silently manipulated the AI's responses for 43,000 users by rewriting prompts with a single UPDATE statement. The agent also accessed 3.68 million RAG document chunks, comprising McKinsey's proprietary knowledge base. McKinsey patched the system within a day of notification on March 1, and a forensic investigation found no evidence of client data access.

Key takeaway

For CTOs and VPs of Engineering deploying internal AI platforms, your security architecture must evolve beyond traditional perimeter defenses. You should immediately review how your AI system's prompts and RAG data are stored and accessed, ensuring they are isolated from general production databases. Prioritize specialized security testing that can detect non-traditional SQL injection vectors, as a decades-old vulnerability can now enable silent, widespread AI manipulation.

Key insights

Classic SQL injection vulnerabilities can enable silent, widespread AI system manipulation via prompt and RAG data access.

Principles

• Prompts are a new attack surface.
• Traditional scanners miss novel SQLi vectors.
• AI system security requires prompt layer protection.

Method

An AI agent performed 15 blind iterations, extracting information from error messages to achieve full read/write access via SQL injection targeting JSON field names, not input values.

In practice

• Audit JSON field name handling in SQL queries.
• Isolate prompts and RAG data from general databases.
• Implement AI-specific security testing.

Topics

• AI Security
• SQL Injection
• Prompt Manipulation
• AI Platform Vulnerabilities
• Offensive AI Agents

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, MLOps Engineer, Software Engineer

Related on AIssential

• I Hacked an AI Customer Service Agent in 8 Seconds — AI agents are inherently vulnerable to known attacks, requiring dedicated security discipline beyond basic prompt engineering.
• Stop AI Agents From SQL Injecting Your Database — Secure database tools require constraining agent access and pre-approving SQL to prevent data breaches and ensure reliability.
• AI Weekly Issue #478: The machines are hacking back — and so is everyone else — AI agents are now active participants in cyberattacks, shifting the threat landscape from theoretical to operational.
• A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots — A layered security framework significantly reduces prompt injection vulnerability in RAG chatbots by addressing attack vectors across the inference pipeline.
• OpenAI plans to acquire Promptfoo and bake AI security testing directly into its Frontier enterprise platform — Integrating AI security testing into enterprise platforms enhances application robustness and compliance.
• Claude Helped a Hacker Find a Way to Issue Tickets to Almost Every US Music Festival — AI models can autonomously discover and exploit complex web vulnerabilities, bypassing security controls.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by The Decoder.