PrivacyMedium
CodeWall's Autonomous Agent Reportedly Obtained Unauthorized Access to McKinsey's Lilli AI Platform Database
- Occurred
- Feb 28, 2026
- Published
- Mar 9, 2026
- Source
- AI Incident Database
Summary
CodeWall reported that its autonomous agent exploited vulnerabilities in McKinsey's Lilli AI platform and obtained unauthorized read and write access to production systems, allegedly exposing internal chat messages, files, user accounts, and prompts. McKinsey confirmed the vulnerability and said it fixed the issue within hours, but said it found no evidence that client data or client confidential information were accessed.
Developers
- McKinsey & Company
- CodeWall
Deployers
- McKinsey & Company
- CodeWall
Harmed parties
- Privacy
- McKinsey & Company employees
- McKinsey & Company consultants
- McKinsey & Company
- Lilli users
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: Unauthorized access to production systems and potential exposure of internal data constitutes a privacy incident, though no confirmed data breach occurred.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8