A security firm's AI agent walked into McKinsey's Lilli in two hours, using a bug older than most of its training data
Ourtake
The vulnerability was a 1990s-era SQL injection. The unsettling part is that the agent needed no help finding it.
What happened
Security firm Codewall ran an autonomous offensive AI agent against McKinsey's internal AI platform Lilli. The agent exploited a SQL injection flaw to reach the production database, including chat messages, files and user accounts. McKinsey patched the flaw within a day of being notified on March 1, and a forensic investigation found no evidence that client data was accessed.