An AI Agent Hacked McKinsey's AI Chatbot in Under 2 Hours

Stories This Week

• Top Story: CodeWall's autonomous AI agent breached McKinsey's internal AI chatbot "Lilli" in under two hours — discovering 22 unauthenticated API endpoints, 46.5 million plain-text messages, and 95 writable system prompts. The attack vector was SQL injection hidden in JSON field key names.
• Chrome Gemini Hijack: A malicious browser extension could silently take over Chrome's built-in Gemini AI panel, inheriting camera, microphone, and file access permissions with no additional user consent. Patched in Chrome 143.
• SGLang RCE (Unpatched): Two critical pickle deserialization vulnerabilities in the SGLang LLM inference framework allow unauthenticated remote code execution. Maintainers unresponsive — sandbox immediately if running in production.
• OpenAI Acquires Promptfoo: Open-source AI red-teaming platform used by 25%+ of Fortune 500 joins OpenAI. Combined with the OpenClaw acqui-hire, OpenAI is building a platform-native agent security stack.
• Google Closes $32B Wiz Deal: Largest cybersecurity acquisition in history. Wiz's multi-cloud AI-SPM merges with Google's Model Armor runtime protection.
• Stealth Startups ($270M): Onyx Security (agent IAM), Armadin (Kevin Mandia's autonomous defense), and Bold Security (endpoint shadow AI detection) all exited stealth.
• Microsoft Prompt Abuse Playbook: MSRC published an IR playbook for prompt injection — Direct Override, Extractive, and Indirect Injection — with detection patterns for Defender, Sentinel, and Purview.

Curator's Corner

Built-in AI security is a sensor, not a solution. OpenAI buying Promptfoo raises the security floor — more model-layer testing, available by default. But the McKinsey breach didn't happen at the model layer. No jailbreak, no prompt injection. The vulnerabilities were unauthenticated APIs and SQL injection in the deployment infrastructure — things no model-layer testing tool would catch. Platform-native security raises the floor, but to truly protect AI, you need to understand the infrastructure underneath it — the tools, the memory, the integrations. That's where the real risk lives.