AI Security Incident
Evidence indicates that the affected technology is affected by a security issue.
What Happened
Evidence indicates that the affected technology is affected by a security issue.
Why This Matters
Current evidence identifies a security issue involving the affected technology, but does not yet support a more specific impact claim.
Recommended Action
No confirmed vendor remediation is available in the current evidence. Confirm whether the affected technology is present in your environment and review the affected configuration.
Exposure
Mar 09, 2026 05:30
Mar 09, 2026 05:30
Exploitation status: UNKNOWN
Primary entities:
Timeline
-
Incident first seen
Mar 09, 2026 05:30BugSkan first recorded this incident.
-
McKinsey's AI agent "Lilli" hacked - by another AI agent - thestack.technology
Mar 09, 2026 05:30thestack.technology · Data Leak
Sources
thestack.technology · Mar 09, 2026 05:30
McKinsey's internal AI agent "Lilli" was breached through classic application security flaws, including an unauthenticated endpoint with a SQL injection vulnerability chained with an IDOR flaw. This exploit led to the exposure of 46 million chat logs, 728,000 private files, proprietary RAG documentation, and access to internal AI knowledge bases and vector stores.
Open publisher sourceWatchlist Match
Create an account to see which incidents overlap with the technologies you monitor.