McKinsey's AI platform fell to SQL injection in two hours

CodeWall's autonomous agent found an unauthenticated SQL injection on McKinsey's internal AI platform Lilli and had full read/write on the production database in under two hours. The take: 46.5 million chat messages, 728,000 files, and the entire proprietary RAG knowledge base — the actual work product of a firm that charges enterprises to advise them on digital risk.

This was not prompt injection. This was not a novel adversarial ML attack. This was OWASP A03, the vulnerability class we've been patching since the Clinton administration, on an endpoint that required no login. If McKinsey shipped that, the median enterprise AI platform is worse.

On the same day, OpenAI published guidance formally reframing prompt injection as social engineering and telling teams to stop trying to filter malicious inputs and start designing for blast-radius containment. Treat manipulation as inevitable. Give each tool its own privilege boundary. Gate irreversible actions. It's the assume-breach doctrine, ported from network security to agents, roughly fifteen years late.

The Lilli breach is what happens when you skip that step. The OpenAI guidance is what happens when the vendors realize everyone skipped it.

The pattern is one story, not two

CodeWall didn't just find the McKinsey bug. The same agent, on a separate target, chained four individually low-severity bugs — permissive CORS, an IDOR, a weak session token, a privilege escalation path — into full admin access on a live hiring platform. No human in the loop. That is the end of CVSS-based triage as a defense strategy. The moment autonomous agents can enumerate combinatorial attack paths at scale, your backlog of risk-accepted mediums becomes an exploit chain you haven't priced.

Add Perplexity's Comet browser getting socially engineered into executing a phishing flow in under four minutes. Add 24,700 n8n instances exposed to an RCE that CISA just added to KEV — n8n workflows that hold your Postgres passwords, S3 keys, model registry tokens, and Slack webhooks. Add HPE Aruba CX switches with a near-CVSS-10 unauthenticated admin takeover. Add three DigitalMint employees allegedly running ALPHV/BlackCat attacks against companies that then hired DigitalMint to negotiate the ransom — $75.25 million, single payments reaching $26.8 million, calibrated by insider knowledge of victims' insurance limits.

Different surfaces. Same failure mode. Every one of them is a trust boundary that was assumed rather than enforced.

Yes, but — someone will read this and say McKinsey is one data point, breach details came from the attacker, and n8n exposure counts include home labs. Fair. The single-incident critique is real. It's also the wrong altitude. The evidence isn't Lilli alone; it's Lilli plus Comet plus the CodeWall chain plus n8n plus DigitalMint in one intelligence cycle. When five independent surfaces fail on trust assumptions in the same week, the base rate is the story.

The infrastructure fell before the model did

The most useful thing to internalize this week is that the failures were not in the models. They were in the plumbing underneath the models, which nobody threat-modeled because the models got all the attention. RAG pipelines have chat interfaces that accept freeform input and backends with broad database permissions — that's a new attack surface, and it inherited none of the two decades of hard-won web application security discipline. Workflow orchestrators are designed to hold credentials and execute with system privileges — that's a lateral movement dream, and most teams don't even have an inventory of where they're running.

Meanwhile the market is loudly repricing something else entirely. A trillion dollars of SaaS market cap evaporated in a week, ServiceNow dropped 11% on a beat, Google bundled managed RAG into Gemini and commoditized the vector-DB category on a Tuesday. Those stories are real. They are also happening on top of an infrastructure layer that just proved, publicly, in two hours, that it hasn't earned the trust the AI narrative requires.

Cyber insurers are already pricing this. They are bifurcating premiums based on AI governance posture — defensive AI down, ungoverned AI up. That's the first CFO-legible dollar cost attached to the gap. Expect it to be the wedge that actually moves budget, not any of the model-quality debates.

What to do this week

One action, specific: run an unauthenticated fuzz and injection sweep against every internal AI platform, RAG endpoint, and chat interface your organization has shipped in the last eighteen months, and put the results in front of an executive by Friday. Not a red-team engagement. Not a quarterly pentest. A same-week check for the vulnerability classes — SQLi, auth bypass, SSRF, IDOR — that predate the AI stack by two decades and that McKinsey just proved are still shipping into production behind the LLM.

If you can't produce that list of endpoints in an afternoon, that's the finding.

While that runs, patch Aruba CX and n8n today, rotate every credential n8n could see, and add per-tool privilege boundaries to any agent system where a single credential set currently reads databases, writes files, and calls external APIs. The blast-radius diagram comes before the prompt. It should have come before the prompt a year ago.