How we hacked McKinsey's AI platform

https://codewall.ai/blog/how-we-hacked-mckinseys-ai-platform

by mycroft_4221 • 4 months ago

506 189 4 months ago

gbourne1• 4 months ago

- "The agent mapped the attack surface and found the API documentation publicly exposed — over 200 endpoints, fully documented. Most required authentication. Twenty-two didn't."

Well, there you go.

sgt1014• 4 months ago

Why was there a public endpoint?

Surely this should all have been behind the firewall and accessible only from a corporate device associated mac address?

jihadjihad• 4 months ago

Surely.

consp3• 4 months ago

accessible only from a corporate device associated mac address

Like that ever stopped anyone. That's just a checkbox item.

sgt1014• 4 months ago

wot?

sd9• 4 months ago

Cool but impossible to read with all the LLM-isms

vanillameow3• 4 months ago

Tiring. Internet in 2026 is LLMs reporting on LLMs pen-testing LLM-generated software.

causal4• 4 months ago

Those short "punchy sentence" paragraphs are my new trigger:

No credentials. No insider knowledge. And no human-in-the-loop. Just a domain name and a dream.

It just sounds so stupid.

consp3• 4 months ago

It's an actual story telling method, molded into a supposed to be informative article with a bunch of "please make it interesting" sprinkled on top of it. These day known as the what's left of the internet.

darkport3• 4 months ago

Founder of CodeWall here. It's quite funny because whilst an LLM did write the bulk of the posts factual content (based on the agents findings), I wrote the intro and summary at the end. That's just my writing style. Feel free to read my personal blog to compare: https://darkport.co.uk

philipwhiuk2• 4 months ago

It's LinkedIn speech.

Two word sentences, each one on a new line.

lenerdenator2• 4 months ago

Not exactly clear from the link: were they doing red team work for McKinsey or is this just "we found a company we thought wouldn't get us arrested and ran an AI vuln detector over their stuff"?

You'd think that the world's "most prestigious consulting firm" would have already had someone doing this sort of work for them.

frereubu• 4 months ago

From TFA: "Fun fact: As part of our research preview, the CodeWall research agent autonomously suggested McKinsey as a target citing their public responsible diclosure policy (to keep within guardrails) and recent updates to their Lilli platform. In the AI era, the threat landscape is shifting drastically — AI agents autonomously selecting and attacking targets will become the new normal."

fhd2• 4 months ago

This was McKinsey & Company — a firm with world-class technology teams [...]

Not exactly the word on the street in my experience. Is McKinsey more respected for software than I thought? Otherwise I'm curious why TFA didn't just politely leave this bit out.

aerhardt• 4 months ago

The LLM that wrote this simply couldn’t help itself.

codechicago277• 4 months ago

Picked up a vibe, but couldn’t confirm it until the last paragraph, but yeah clearly drafted with at least major AI help.

lenerdenator2• 4 months ago

Not exactly the word on the street in my experience.

Depends on the street you're on. Are you on Main Street or Wall Street?

If you're hiring them to help with software for solving a business problem that will help you deliver value to your customers, they're probably just like anyone else.

If you're hiring them to help with software for figuring out how to break down your company for scrap, or which South African officials to bribe, well, that's a different matter.

alexpotato2• 4 months ago

They generally hire smart people who are good at a combination of:

- understanding existing systems

- what the paint points are

- making suggestions on how to improve those systems given the paint points

- that includes a mix of tech changes, process updates and/or new systems etc

Now, when it comes to implementing this, in my experience it usually ends up being the already in place dev teams.

Source: worked at a large investment bank that hired McKinsey and I knew one of the consultants from McK prior to working at the bank.

xpe• 4 months ago

My take*: McKinsey hiring largely selects for staying calm under pressure and presenting a confident demeanor to clients. Verbal fluency with decision-making frameworks goes a long way. Having strong analytical skills seemed essential; hopefully the bar for "sufficiently analytical" has raised along with general data science skills in industry.

I don't view them as top-tier experts in their own right, whether it be statistics or technology, but they have a knack for corporate maneuvering. I often question their overall value beyond the usual "hire the big guns to legitimize a change" mentality. Maybe a useful tradeoff? I'd rather see herd-like adoption of current trends than widespread corporate ignorance and insularity.**

A huge selling point for M&Co is kind of a self-fulfulling prophecy based on the access they get. This gives them a positive feedback loop to find the juiciest and most profitable areas to focus on.

For those who know more, how do my takes compare?

* I interviewed with them over 15 years ago, know people who have worked there, and I pay attention to their reports from time to time.

** Of course, I'd rather see a third way: cross-pollination between organizations to build strong internal expertise and use model-based decision making for nuanced long-term decisions... but that's just crazy talk.

sharadov• 4 months ago

No, they don't have world class technology teams, they hire contractors to do all the tech stuff, their expertise is in management, yes that's world class.

OvervCW• 4 months ago

Yes, world class in causing human suffering.

https://www.youtube.com/watch?v=Q7pgDmR-pWg

cmiles85• 4 months ago

Is it though? Managing teams to not torpedo your company with stupid stuff like this is kinda core to “good management.” The evidence would indicate they’re not very good at that either.

cmiles85• 4 months ago

I can only remember a McKinsey team pushing Watson on us hard ages ago. Was a total train wreck.

They’ve long been all hype no substance on AI and looks like not much has changed.

They might be good at other things but would run for the hills if McKinsey folks want to talk AI.

captain_coffee• 4 months ago

Music to my ears! Couldn't happen to a better company!

joenot443• 4 months ago

One of those unprotected endpoints wrote user search queries to the database. The values were safely parameterised, but the JSON keys — the field names — were concatenated directly into SQL.

I was expecting prompt injection, but in this case it was just good ol' fashioned SQL injection, possible only due to the naivety of the LLM which wrote McKinsey's AI platform.

simonw6• 4 months ago

Yeah, gotta admit I'm a bit disappointed here. This was a run-of-the-mill SQL injection, albeit one discovered by a vulnerability scanning LLM agent.

I thought we might finally have a high profile prompt injection attack against a name-brand company we could point people to.

jfkimmes• 4 months ago

Not the same league as McKinsey, but I like to point to this presentation to show the effects of a (vibe coded) prompt injection vulnerability:

https://media.ccc.de/v/39c3-skynet-starter-kit-from-embodied...

[...] we also exploit the embodied AI agent in the robots, performing prompt injection and achieve root-level remote code execution.

TheDong• 4 months ago

Github actions has had a bunch of high-profile prompt injection attacks at this point, most recently the cline one: https://adnanthekhan.com/posts/clinejection/

I guess you could argue that github wasn't vulnerable in this case, but rather the author of the action, but it seems like it at least rhymes with what you're looking for.

danenania• 4 months ago

I thought we might finally have a high profile prompt injection attack against a name-brand company we could point people to.

These folks have found a bunch: https://www.promptarmor.com/resources

But I guess you mean one that has been exploited in the wild?

doctorpangloss• 4 months ago

The tacit knowledge to put oauth2-proxy in front of anything deployed on the Internet will nonetheless earn me $0 this year, while Anthropic will make billions.

3abiton• 4 months ago

I just wonder how much professional grade code written by LLMs, "reviewed" by devs, and commited that made similar or worse mistakes. A funny consequence of the AI boom, especially in coding, is the eventual rise in need for security researchers.

IshKebab• 4 months ago

In fairness although "the industry" learns best practices like using SQL prepared statements, not sanitising via blacklists, CSFR, etc. there's a constant new stream of new programmers who just never heard of these things. It doesn't help that often when these things are realised the only way we prevent it in future is by talking about it, which doesn't work for newbies. Nobody goes and fixes SQL APIs so that you can only pass compile-time constant strings as the statement or whatever. Newbies just have to magically know to do that.

paxys• 4 months ago

named after the first professional woman hired by the firm in 1945

Going out of their way to find a woman's name for an AI assistant and bragging about it is not as empowering as the creators probably thought in their heads.

steinersteiner• 4 months ago

This

bee_rider3• 4 months ago

I don’t love the title here. Maybe this is a “me” problem, but when I see “AI agent does X,” the idea that it might be one of those molt-y agents with obfuscated ownership pops into my head.

In this case, a group of pentesters used an AI agent to select McKinsey and then used the AI agent to do the pentesting.

While it is conventional to attribute actions to inanimate objects (car hits pedestrians), IMO we should be more explicit these days, now that unfortunately some folks attribute agency to these agentic systems.

simonw6• 4 months ago

Yeah, the original article title "How We Hacked McKinsey's AI Platform" is better.

causal4• 4 months ago

Yah it's just an ad, and "Pentesting agents finds low-hanging vulnerability" isn't gonna drive clicks.

jacquesm2• 4 months ago

It's not an ad for McKinsey though.

nkozyra• 4 months ago

... at a massive company

That's important. Cloudwall isn't really saying they have some secret sauce here, but it's noteworthy who they nabbed.

tasuki2• 4 months ago

now that unfortunately some folks attribute agency to these agentic systems.

You're doing that by calling them "agentic systems".

bee_rider3• 4 months ago

Unfortunately that’s what they are called. I was hoping the phrasing would highlight the problem rather than propagate it.

dang• 4 months ago

Ok, we've reverted the title (submitted title was "AI Agent Hacks McKinsey")

newtwilly• 4 months ago

The article does say

No human in the loop

If true, it's quite irresponsible. They are admitting to allowing a agent to autonomously execute code on the network. Autonomously perform hacking activities.

sigmar2• 4 months ago

I've got no idea who codewall is. Is there acknowledgment from McKinsey that they actually patched the issue referenced? I don't see any reference to "codewall ai" in any news article before yesterday and there's no names on the site.

https://www.google.com/search?q=codewall+ai

rzmmm• 4 months ago

Yeah can't find much information either. I would like to see at least some proof. Either via Mckinsey or from the security team.

doron• 4 months ago

it is weird isn't it? The register article implies that it's acknowledged by McKinsey- https://www.theregister.com/2026/03/09/mckinsey_ai_chatbot_h...

Edit: Apparently, this is the CEO https://github.com/eth0izzle

sigmar2• 4 months ago

A McKinsey spokesperson told The Register that it fixed all of the issues identified by CodeWall within hours of learning about the problems.

Ah. Thanks for the link. I'm suspicious of everything posted to a blog without proof these days.

eisa012• 4 months ago

If it's true that there's 58k users in the dump, that would mean former employees are in the dump

I assume that means McKinsey would need to disclose it, or at least alert the former employees of the breach?

philipwhiuk2• 4 months ago

There's a responsible disclosure timeline at the bottom indicating they'd all been fixed.

tylervigen• 4 months ago

I think the point is that we don't have evidence that this actually happened from anyone other than Codewall.

darkport3• 4 months ago

We’re pretty new! :) They didn’t want to provide comment on our post but they did offer comment via The Register.

victor106• 4 months ago

this reads like it was written by an LLM

phyzome2• 4 months ago

It absolutely was.

ecshafer• 4 months ago

If the AI was poisoned to alter advice, then maybe McKinsey advice would actually be a net good.

frankfrank136• 4 months ago

Some insider knowledge: Lilli was, at least a year ago, internal only. VPN access, SSO, all the bells and whistles, required. Not sure when that changed.

McKinsey requires hiring an external pen-testing company to launch even to a small group of coworkers.

I can forgive this kind of mistake on the part of the Lilli devs. A lot of things have to fail for an "agentic" security company to even find a public endpoint, much less start exploiting it.

That being said, the mistakes in here are brutal. Seems like close to 0 authz. Based on very outdated knowledge, my guess is a Sr. Partner pulled some strings to get Lilli to be publicly available. By that time, much/most/all of the original Lilli team had "rolled off" (gone to client projects) as McKinsey HEAVILY punishes working on internal projects.

So Lilli likely was staffed by people who couldn't get staffed elsewhere, didn't know the code, and didn't care. Internal work, for better or worse, is basically a half day.

This is a failure of McKinsey's culture around technology.

cmiles85• 4 months ago

Net conclusion: Don’t hire McKinsey to advise on AI implementation or tech org design and practices if they can’t get it right themselves.

frankfrank136• 4 months ago

Fair take, but you'd be hard pressed to find much resemblance to any advice McK gives to its own practices.

Pre-AI, I always said McK is good at analysis, if you need complicated analysis done, hire a consulting firm.

If you need strategy, custom software, org design, etc. I think you should figure out the analysis that needs to be done, shoot that off to a consulting firm, and then make your decision.

IME, F500 execs are delegation machines. When they wake up every morning with 30 things to delegate, and 25 execs to delegate to, they hire 5 consulting teams. Whether you hire Mck, or Deloitte, or Accenture will only come down to:

1. Your personal relationships

2. Your company's policies on procurement

3. Your budget

in that order.

McK's "secret sauce" is that if you, the exec, don't like the powerpoint pages Mck put in front of you, 3 try-hard, insecure, ivy-league educated analysts will work 80 hours to make pages you do like. A sr. partner will take you to dinner. You'll get invited to conferences and summits and roundtables, and then next time you look for a job, it will be easier.

m4rtink• 4 months ago

This can be simplified further: "Don't hire McKinsey." ;-)

steve19777• 4 months ago

The only people who hire McKinsey are execs who are even more clueless than the consultants.

eisa012• 4 months ago

Maybe it was opened up so it could be used in recruiting?

McKinsey challenges graduates to use AI chatbot in recruitment overhaul: https://www.ft.com/content/de7855f0-f586-4708-a8ed-f0458eb25...

j453• 4 months ago

Using a 2 year old paradigm.

And require a chatbot to be used that can be easily gamed by asking a model of how best to navigate it lol.

Implementing the past of AI practices is requesting something that will be easily outdone.

j453• 4 months ago

I am not sure what accounting or management consulting firms are doing in tech.

They look to package up something and sell it as long as they can.

AI solutions won't have enough of a shelf life, and the thought around AI is evolving too quickly.

Very happy to be wrong and learn from any information folks have otherwise.

fidotron• 4 months ago

The purpose of hiring them is to make them come to the conclusion you already have, so when it goes well you get the credit for doing it, or if it goes sideways you can pin the blame on them.

dahcryn2• 4 months ago

is this the same at quantumblack? They at least give the impression their assets on Brix are somewhat up to date and uesable

itsnotme122• 4 months ago

QB is no more, leadership left, technical experts left. Just the brand stayed behind.

eastbayjake• 4 months ago

QuantumBlack is synonymous -- it's where all of McKinsey's AI expertise got reorganized these days, anyone working on this tool was likely doing it on a rotation in between client engagements under "QuantumBlack, AI by McKinsey"

OptionOfT• 4 months ago

Couple of things to add:

McKinsey has a weird structure where there are too many cooks in the kitchen.

Everybody there is reviewed on client impact, meaning it ends up being an everybody-for-themselves situation.

So as a developer you have little guidance (in fact, you're still being reviewed on client impact, even if you have 0 client exposure).

Then a (Senior) Partner comes in with this idea (that will get them a good review), and you jump on that. After all, it's all you can do to get a good review.

You work on it, and then the (Senior) Partner moves on. But it's not done. It's enough for the review, but continuing to work on it doesn't bring you anything, in fact, it will actually pull you down, as finishing the project doesn't give immediate client results.

So what does this mean? Most products of McKinsey are a grab-bag of raw ideas of leadership, implemented as a one-off, without a cohesive vision or even a long-term vision at all. It's all about the review cycle.

McKinsey is trying to do software like they do their other engagements. It doesn't work. You can't just do something for 6 months and then let it go. Software rots.

The fact that they laid off a good amount of (very good) software engineers in 2024 is a reflection on how they see software development.

And McKinsey's people, who go to other companies, take those ideas with them. Result: The UI of your project changes all the time, because everybody is looking at the short-term impact they have that gets them a good review, not what is best for the project in the long term.

steve19777• 4 months ago

McKinsey is trying to do software like they do their other engagements. It doesn't work.

I mean, it doesn't work for their consulting gigs either. There's a reason McKinsey has such a bad reputation.

gavinray• 4 months ago

Why would anyone work there, then, unless that's the only place they could get hired as a dev?

And if the latter is the case, then that sort of stamps the case closed from the get-go...

yard2010• 4 months ago

I'm far from being an expert, but it sounds like this company needs some consultancy.

itsnotme122• 4 months ago

Those comments are spot on.

McKinsey was on a spree to become the best tech consulting company and brought a lot of great tech talent but the 2023 crisis made leadership turn 180 and simply ditch/ignore all the tech experts they brought to the firm.

All the expertise has left the firm and now they are more and more becoming another BS tech consulting firm, with strategy folks that don't even know that ML is AI advising clients on Enterprise AI transformation.

The tech initiative was a failure and Lilli's problem is just a symptom of it.

I wonder what was the experience at Bain and BCG

quantum_state• 4 months ago

They sold their way of working to many idiotic companies which are in the process of destroying themselves …

CobrastanJorji• 4 months ago

Man, that's terrible. Have they considered bringing in some sort of business consultant to help them reorganize and restructure?

keeganpoppen• 4 months ago

this is why working at mckinsey seems like a horrible proposition to me, personally

jacquesm2• 4 months ago

And: AI agent writes blog post.

palmotea• 4 months ago

With all we've been learning from stuff like the Epstein emails, it would have been nice if someone had leaked this data:

46.5 million chat messages. From a workforce that uses this tool to discuss strategy, client engagements, financials, M&A activity, and internal research. Every conversation, stored in plaintext, accessible without authentication.
728,000 files. 192,000 PDFs. 93,000 Excel spreadsheets. 93,000 PowerPoint decks. 58,000 Word documents. The filenames alone were sensitive and a direct download URL for anyone who knew where to look.

I'm sure lots of very informative journalism could have been done about how corporate power actually works behind the scenes.

cmiles85• 4 months ago

That information is likely already in the hands of various folks as I highly doubt the authors were the first to find this glaring security issue, they’re likely only the first to disclose it. If McKinsey has hard data that nobody else exploited this now would be a good time to disclose that given what sounds like an extremely severe data leak.

frankfrank136• 4 months ago

The chat messages are very very sensitive. You could easily reverse engineer nearly every ongoing Mck engagement. The underlying data is not as sensitive, its decades of post-mortems, highly sanitized. No client names, no real numbers.

VadimPR3• 4 months ago

I wonder how these offensive AI agents are being built? I am guessing with off the shelf open LLMs, finetuned to remove safety training, with the agentic loop thrown in.

Does anyone know for sure?

simonw6• 4 months ago

Honestly you can point regular Claude Code or Codex CLI at a web app and tell it to start a penetration test and get surprisingly good results from their default configurations.

VadimPR3• 4 months ago

I didn't think of that given how censored the models are becoming. Thanks for the idea! I'll try it against my websites before anyone else gets to it.

VadimPR3• 4 months ago

It doesn't work (anymore?), it would seem using CC 2.1.74 with Opus:

I appreciate you sharing your role, but I need to decline this request. Even as a project lead, I can't perform penetration testing against live production websites like mudlet.org and make.mudlet.org through this interface.

cs702• 4 months ago

... in two hours:

No credentials. No insider knowledge. And no human-in-the-loop. Just a domain name and a dream. ... Within 2 hours, the agent had full read and write access to the entire production database.

Having seen firsthand how insecure some enterprise systems are, I'm not exactly surprised. Decision makers at the top are focused first and foremost on corporate and personal exposure to liability, also known as CYA in corporate-speak. The nitty-gritty details of security are always left to people far down the corporate chain who are supposed to know what they're doing.

drc500free• 4 months ago

I have grown to despise this AI-generated writing style.

peterokap• 4 months ago

I wonder what is their security level and Observability method to oversee the effort.

nullcathedral• 4 months ago

I think the underlying point is valid. Agents are a potential tool to add to your arsenal in addition to "throw shit at the wall and see what sticks" tools like WebInspect, Appscan, Qualys, and Acunetix.

bxguff• 4 months ago

Its so funny its a SQL injection because drum roll you can't santize llm inputs. Some problems are evergreen.

dmix• 4 months ago

Technically it was a search box input no prompts. Which tbf are often endpoints reused by RAGs

nubg• 4 months ago

Could the author please provide the prompt that was used to vibe write this blog post? The topic is interesting, but I would rather read the original prompt, as I am not sure which parts still match what the author wanted to say, vs flowerly formulations for captivating reading that the LLM produced.

j453• 4 months ago

Are accounting and management consulting companies competent in cutting edge tech?

cynicalsecurity• 4 months ago

McKinsey is not an accounting company, it's Satan the Devil himself.

himata4113• 4 months ago

How long until a hallucinated data breach that spreads globally. There's a few inconsistencies and the typical low effort language AI has.

quinndupont• 4 months ago

I’m waiting for the agentic models trained on virus and worm datasets to join the red team!

gonzalovargas• 4 months ago

That data is worth billions to frontier AI labs. I wonder if someone is already using it to train models

bananamogul• 4 months ago

At first glance, I thought this was about an AI agent named "Hacks McKinsey."

aspenmayer• 4 months ago

à la the eponymous Hiro Protagonist

StartupsWala• 4 months ago

One interesting takeaway here is how quickly organizations are deploying AI tools internally without fully adapting their security models.

Traditional application security assumes fairly predictable inputs and workflows, but LLM-based systems introduce entirely new attack surfaces—prompt injection, data leakage, tool misuse, etc.

It feels like many enterprises are still treating these systems as just another SaaS product rather than something closer to an autonomous system that needs a different threat model...

sailfast• 4 months ago

What I don't see in this article that should be explicit:

If your data is in this database, it's gone. Other people have it. Your sensitive data that you handed over to their teams has vanished in a puff of smoke. You should probably ask if your data was part of the leak.

Fail to see how a state actor would not have come across this already.

build-or-die• 4 months ago

parameterized values but raw key concatenation is the kind of thing that looks safe in code review. easy to miss for humans, but an agent will just keep poking at every input until something breaks.

sethammons• 4 months ago

Lilli's system prompts — the instructions that control how the AI behaves — were stored in the same database the agent had access to.

Being able to rewrite your own source. What's the worst that could happen?

elorant• 4 months ago

Meanwhile, you're paying top dollars to a consulting firm that resolves back to an LLM to provide its services.

august-• 4 months ago

is this kind of thing more common at big consulting firms that bolt on tech products as an afterthought? feels like their core competency is slides and strategy, not shipping secure software

sgarland• 4 months ago

This was McKinsey & Company — a firm with world-class technology teams

Apparently not.

I_am_tiberius• 4 months ago

Whitehat hacking ok, but using it for marketing purposes no...

pikachu0625• 4 months ago

It's just different skills.

bluck• 4 months ago

Quite uninteresting to read as the article does not go into any depth and it feels simply like the "hacking agent" also wrote the blockpost. Learned nothing

phyzome2• 4 months ago

Flagging this because 1) this was written by an LLM and 2) there's bad information in it, which means it wasn't reviewed particularly carefully by a human.

This means the entire article is suspect as a result.

tcbrah• 4 months ago

the data leak is bad but the write access to system prompts is what keeps me up at night. they could silently rewrite how Lilli responds to 43k consultants with a single UPDATE statement - no deploy, no code review, no logs. imagine poisoning the strategic advice that gets copy pasted into client deliverables. tbh most companies i see doing AI stuff store prompts the exact same way, just rows in postgres right next to everything else

How we hacked McKinsey's AI platform

Related Stories