How we hacked McKinsey's AI platform • Hacker News Board

Re: How we hacked McKinsey's AI platform

#81

Post by decidu0us9034 » Wed, Mar 11, 2026, 5:14 PM UTC

frankfrank13 wrote: post #63

cmiles8 wrote: post #52

Earlier quoted context omitted.

Net conclusion: Don’t hire McKinsey to advise on AI implementation or tech org design and practices if they can’t get it right themselves.

Fair take, but you'd be hard pressed to find much resemblance to any advice McK gives to its own practices. Pre-AI, I always said McK is good at analysis, if you need complicated analysis done, hire a consulting firm. If you need strategy, custom software, org design, etc. I think you should figure out the analysis that needs to be done, shoot that off to a consulting firm, and then make your decision. IME, F500 exec…

Analysis of what? What does that mean? What's something you conceivably would need a consulting firm to "analyze?" I don't understand why management consulting firms would hire software people in the first place, and then punish them for not being on a client-facing project. That seems a bit contradictory to me, but this is all way out of my wheelhouse

Re: How we hacked McKinsey's AI platform

#82

Post by steve1977 » Wed, Mar 11, 2026, 5:17 PM UTC

OptionOfT wrote: post #76

frankfrank13 wrote: post #33

Some insider knowledge: Lilli was, at least a year ago, internal only. VPN access, SSO, all the bells and whistles, required. Not sure when that changed. McKinsey requires hiring an external pen-testing company to launch even to a small group of coworkers. I can forgive this kind of mistake on the part of the Lilli devs. A lot of things have to fail for an "agentic" security company to even find a public endpoint, mu…

Couple of things to add: McKinsey has a weird structure where there are too many cooks in the kitchen. Everybody there is reviewed on client impact, meaning it ends up being an everybody-for-themselves situation. So as a developer you have little guidance (in fact, you're still being reviewed on client impact, even if you have 0 client exposure). Then a (Senior) Partner comes in with this idea (that will get them a g…

> McKinsey is trying to do software like they do their other engagements. It doesn't work.

I mean, it doesn't work for their consulting gigs either. There's a reason McKinsey has such a bad reputation.

Re: How we hacked McKinsey's AI platform

#83

Post by quinndupont » Wed, Mar 11, 2026, 5:17 PM UTC

I’m waiting for the agentic models trained on virus and worm datasets to join the red team!

Re: How we hacked McKinsey's AI platform

#84

Post by steve1977 » Wed, Mar 11, 2026, 5:19 PM UTC

cmiles8 wrote: post #52

frankfrank13 wrote: post #33

Some insider knowledge: Lilli was, at least a year ago, internal only. VPN access, SSO, all the bells and whistles, required. Not sure when that changed. McKinsey requires hiring an external pen-testing company to launch even to a small group of coworkers. I can forgive this kind of mistake on the part of the Lilli devs. A lot of things have to fail for an "agentic" security company to even find a public endpoint, mu…

Net conclusion: Don’t hire McKinsey to advise on AI implementation or tech org design and practices if they can’t get it right themselves.

The only people who hire McKinsey are execs who are even more clueless than the consultants.

Re: How we hacked McKinsey's AI platform

#85

Post by gonzalovargas » Wed, Mar 11, 2026, 5:22 PM UTC

That data is worth billions to frontier AI labs. I wonder if someone is already using it to train models

Re: How we hacked McKinsey's AI platform

#86

Post by frankfrank13 » Wed, Mar 11, 2026, 5:24 PM UTC

boringg wrote: post #80

fidotron wrote: post #74

Earlier quoted context omitted.

The purpose of hiring them is to make them come to the conclusion you already have, so when it goes well you get the credit for doing it, or if it goes sideways you can pin the blame on them.

Or, alternatively, there are so many companies that are weak on tech they pay for someone else to guide them.

Yeah its more this, the companies who ask Mck's help in software tend to hire contractors or vend out software already.

Re: How we hacked McKinsey's AI platform

#87

Post by bananamogul » Wed, Mar 11, 2026, 5:27 PM UTC

At first glance, I thought this was about an AI agent named "Hacks McKinsey."

Re: How we hacked McKinsey's AI platform

#88

Post by VadimPR » Wed, Mar 11, 2026, 5:30 PM UTC

simonw wrote: post #68

VadimPR wrote: post #42

I wonder how these offensive AI agents are being built? I am guessing with off the shelf open LLMs, finetuned to remove safety training, with the agentic loop thrown in. Does anyone know for sure?

Honestly you can point regular Claude Code or Codex CLI at a web app and tell it to start a penetration test and get surprisingly good results from their default configurations.

I didn't think of that given how censored the models are becoming. Thanks for the idea! I'll try it against my websites before anyone else gets to it.

Re: How we hacked McKinsey's AI platform

#89

Post by [deleted] » Wed, Mar 11, 2026, 5:32 PM UTC

sigmar wrote: post #21

I've got no idea who codewall is. Is there acknowledgment from McKinsey that they actually patched the issue referenced? I don't see any reference to "codewall ai" in any news article before yesterday and there's no names on the site. https://www.google.com/search?q=codewall+ai

[deleted]

Re: How we hacked McKinsey's AI platform

#90

Post by StartupsWala » Wed, Mar 11, 2026, 5:35 PM UTC

One interesting takeaway here is how quickly organizations are deploying AI tools internally without fully adapting their security models.

Traditional application security assumes fairly predictable inputs and workflows, but LLM-based systems introduce entirely new attack surfaces—prompt injection, data leakage, tool misuse, etc.

It feels like many enterprises are still treating these systems as just another SaaS product rather than something closer to an autonomous system that needs a different threat model...