An Autonomous Agent, No Credentials, Full Access

This week, security researchers at CodeWall.ai published one of the most consequential AI security disclosures in recent memory. Their autonomous offensive AI agent — operating with no credentials, no insider knowledge, and no human in the loop — breached McKinsey & Company's internal AI platform, Lilli, in under two hours.

What it found: 46.5 million chat messages, 728,000 files (including 192,000 PDFs and 93,000 Excel spreadsheets), 57,000 employee accounts, and 384,000 AI assistants with their full configuration details.

Lilli is not some prototype. It's McKinsey's production AI system, used by over 70% of its 43,000+ consultants to discuss strategy, client engagements, M&A activity, and proprietary research. The platform processes 500,000+ prompts per month.

The breach pathway was instructive: the agent discovered 200+ API endpoints with full documentation publicly exposed. Twenty-two of those endpoints required no authentication. One of them had a SQL injection vulnerability that standard security scanning tools — including OWASP ZAP — failed to detect. The vulnerability was in JSON key names being concatenated into SQL queries rather than parameterized values — a subtle class of injection that most automated tools aren't designed to catch.

Why This Matters Beyond McKinsey

This isn't just a McKinsey story. It's a structural warning about how most organizations are deploying AI today.

The centralized vendor model is the problem. When organizations deploy AI through a shared cloud platform — with shared API endpoints, shared infrastructure, and shared attack surfaces — a single vulnerability exposes everything. Every user's data. Every conversation. Every document.

Most enterprise AI deployments today follow this pattern: buy access to a vendor's platform, connect your data, and hope their security team is better than the attackers. The McKinsey breach shows what happens when that assumption fails.

AI agents are now both the tool and the threat. The CodeWall agent autonomously selected McKinsey as a target, mapped the attack surface, identified the vulnerability class, and iterated through fifteen blind SQL injection attempts — each one informed by the previous error message. This level of autonomous offense was theoretical two years ago. It's operational now.

The Architecture That Withstands This

The lesson isn't to avoid AI. It's to deploy it differently. Organizations need AI infrastructure that is:

1. Isolated by design. Each organization's AI runs in its own dedicated sandbox — not on shared infrastructure with shared endpoints. A breach in one tenant cannot cascade to another.

2. Owned, not rented. When you have the full source code, your security team can audit every line, patch vulnerabilities on your timeline, and understand exactly what's running. You're not waiting for a vendor's disclosure.

3. Air-gappable. Sensitive environments — government, healthcare, finance — need the option to run AI completely disconnected from the public internet. No external API calls. No data leaving the perimeter.

4. Multi-tenant with true isolation. If you're running AI for multiple departments, schools, or business units, each tenant needs its own data boundary, its own access controls, and its own encryption keys.

This is exactly the architecture behind ibl.ai's Agentic OS. Organizations deploy the full AI operating system — connectors, policy engine, agent interfaces, and all infrastructure — on their own servers. They receive the complete codebase. They control every layer of the stack.

The Role-Based Agent Model

The McKinsey breach also exposed 384,000 AI assistants and 94,000 workspaces — revealing the full organizational structure of how the firm uses AI internally. System prompts, model configurations, and guardrail settings were all accessible.

This highlights another critical design principle: AI agents need role-based access controls as rigorous as human employees.

At ibl.ai, every agent built through our AI Transformation service has defined responsibilities, access boundaries, escalation protocols, and performance reviews. Agents don't get blanket access to organizational data. They get scoped permissions — just like a new hire.

The MentorAI platform enforces this at the product level: instructors control which datasets are visible to students, which tools agents can use, and what safety guardrails are active. Every conversation is auditable through comprehensive analytics that track engagement, topics, costs, and transcripts.

What Organizations Should Do Now

If you're deploying AI at institutional scale, here's what this breach should prompt:

• Audit your attack surface. Are your AI platform's API endpoints authenticated? All of them?
• Review your data isolation. Is your AI data truly isolated from other tenants, or are you sharing infrastructure?
• Evaluate ownership. Can your security team audit the AI platform's source code? Can you patch independently?
• Stress-test with offensive AI. The tools that breached McKinsey are available. If you're not testing your own systems with autonomous agents, someone else will.

The era of AI agents operating autonomously — for both productive and destructive purposes — is here. The organizations that thrive will be the ones whose AI infrastructure was designed for this reality from the beginning.

---

ibl.ai provides the Agentic AI Operating System for organizations that need full ownership of their AI infrastructure. Learn more at ibl.ai or explore the documentation.