Live data from Hacker News

How we hacked McKinsey's AI platform

codewall.ai

91–100 of 213 posts

Re: How we hacked McKinsey's AI platform

#91
post #21

I've got no idea who codewall is. Is there acknowledgment from McKinsey that they actually patched the issue referenced? I don't see any reference to "codewall ai" in any news article before yesterday and there's no names on the site. https://www.google.com/search?q=codewall+ai

There's a responsible disclosure timeline at the bottom indicating they'd all been fixed.

Re: How we hacked McKinsey's AI platform

#92
post #26
post #4

Cool but impossible to read with all the LLM-isms

Those short "punchy sentence" paragraphs are my new trigger: > No credentials. No insider knowledge. And no human-in-the-loop. Just a domain name and a dream. It just sounds so stupid.

It's LinkedIn speech.

Two word sentences, each one on a new line.

Re: How we hacked McKinsey's AI platform

#93

Earlier quoted context omitted.

Picked up a vibe, but couldn’t confirm it until the last paragraph, but yeah clearly drafted with at least major AI help.

Can we stop softening the blow? This isn't "drafted with at least major AI help", it's just straight up AI slop writing. Let's call a spade a spade. I have yet to meet anyone claiming they "write with AI help but thoughts are my own" that had anything interesting to say. I don't particularly agree with a lot of Simon Willison's posts but his proofreading prompt should pretty much be the line on what constitutes accep…

Sorry but seems like most people don't care or even like AI writing more:

https://x.com/kevinroose/status/2031397522590282212

Re: How we hacked McKinsey's AI platform

#94

Earlier quoted context omitted.

Fair take, but you'd be hard pressed to find much resemblance to any advice McK gives to its own practices. Pre-AI, I always said McK is good at analysis, if you need complicated analysis done, hire a consulting firm. If you need strategy, custom software, org design, etc. I think you should figure out the analysis that needs to be done, shoot that off to a consulting firm, and then make your decision. IME, F500 exec…

Analysis of what? What does that mean? What's something you conceivably would need a consulting firm to "analyze?" I don't understand why management consulting firms would hire software people in the first place, and then punish them for not being on a client-facing project. That seems a bit contradictory to me, but this is all way out of my wheelhouse

For instance, what would we need to start offering siracha in our burger?

Re: How we hacked McKinsey's AI platform

#95
post #8

> This was McKinsey & Company — a firm with world-class technology teams [...] Not exactly the word on the street in my experience. Is McKinsey more respected for software than I thought? Otherwise I'm curious why TFA didn't just politely leave this bit out.

No, they don't have world class technology teams, they hire contractors to do all the tech stuff, their expertise is in management, yes that's world class.

Is it though? Managing teams to not torpedo your company with stupid stuff like this is kinda core to “good management.” The evidence would indicate they’re not very good at that either.

Re: How we hacked McKinsey's AI platform

#96
post #30

I don’t love the title here. Maybe this is a “me” problem, but when I see “AI agent does X,” the idea that it might be one of those molt-y agents with obfuscated ownership pops into my head. In this case, a group of pentesters used an AI agent to select McKinsey and then used the AI agent to do the pentesting. While it is conventional to attribute actions to inanimate objects (car hits pedestrians), IMO we should be…

> now that unfortunately some folks attribute agency to these agentic systems. You're doing that by calling them "agentic systems".

Unfortunately that’s what they are called. I was hoping the phrasing would highlight the problem rather than propagate it.

Re: How we hacked McKinsey's AI platform

#97

With all we've been learning from stuff like the Epstein emails, it would have been nice if someone had leaked this data: > 46.5 million chat messages. From a workforce that uses this tool to discuss strategy, client engagements, financials, M&A activity, and internal research. Every conversation, stored in plaintext, accessible without authentication. > 728,000 files. 192,000 PDFs. 93,000 Excel spreadsheets. 93,000…

That information is likely already in the hands of various folks as I highly doubt the authors were the first to find this glaring security issue, they’re likely only the first to disclose it. If McKinsey has hard data that nobody else exploited this now would be a good time to disclose that given what sounds like an extremely severe data leak.

Re: How we hacked McKinsey's AI platform

#98
post #8

> This was McKinsey & Company — a firm with world-class technology teams [...] Not exactly the word on the street in my experience. Is McKinsey more respected for software than I thought? Otherwise I'm curious why TFA didn't just politely leave this bit out.

They generally hire smart people who are good at a combination of: - understanding existing systems - what the paint points are - making suggestions on how to improve those systems given the paint points - that includes a mix of tech changes, process updates and/or new systems etc Now, when it comes to implementing this, in my experience it usually ends up being the already in place dev teams. Source: worked at a lar…

My take*: McKinsey hiring largely selects for staying calm under pressure and presenting a confident demeanor to clients. Verbal fluency with decision-making frameworks goes a long way. Having strong analytical skills seemed essential; hopefully the bar for "sufficiently analytical" has raised along with general data science skills in industry.

I don't view them as top-tier experts in their own right, whether it be statistics or technology, but they have a knack for corporate maneuvering. I often question their overall value beyond the usual "hire the big guns to legitimize a change" mentality. Maybe a useful tradeoff? I'd rather see herd-like adoption of current trends than widespread corporate ignorance and insularity.**

A huge selling point for M&Co is kind of a self-fulfulling prophecy based on the access they get. This gives them a positive feedback loop to find the juiciest and most profitable areas to focus on.

For those who know more, how do my takes compare?

* I interviewed with them over 15 years ago, know people who have worked there, and I pay attention to their reports from time to time.

** Of course, I'd rather see a third way: cross-pollination between organizations to build strong internal expertise and use model-based decision making for nuanced long-term decisions... but that's just crazy talk.

Re: How we hacked McKinsey's AI platform

#99

Earlier quoted context omitted.

Fair take, but you'd be hard pressed to find much resemblance to any advice McK gives to its own practices. Pre-AI, I always said McK is good at analysis, if you need complicated analysis done, hire a consulting firm. If you need strategy, custom software, org design, etc. I think you should figure out the analysis that needs to be done, shoot that off to a consulting firm, and then make your decision. IME, F500 exec…

Analysis of what? What does that mean? What's something you conceivably would need a consulting firm to "analyze?" I don't understand why management consulting firms would hire software people in the first place, and then punish them for not being on a client-facing project. That seems a bit contradictory to me, but this is all way out of my wheelhouse

Analysis:

1. How do I build a datacenter

2. How is the industrial ceramic market structured, how do they perform

3. How does a changing environment impact life insurance

Strategy:

1. Should I build a datacenter

2. Should I invest in an industrial ceramics company

3. Should I divest my life insurance subsidiary

Specifically in the software world this would be "automate some esoteric ERP migration" or "build this data pipeline" vs. "how can we be more digital native" or "how do we integrate more AI into our company"

Re: How we hacked McKinsey's AI platform

#100
post #97

With all we've been learning from stuff like the Epstein emails, it would have been nice if someone had leaked this data: > 46.5 million chat messages. From a workforce that uses this tool to discuss strategy, client engagements, financials, M&A activity, and internal research. Every conversation, stored in plaintext, accessible without authentication. > 728,000 files. 192,000 PDFs. 93,000 Excel spreadsheets. 93,000…

That information is likely already in the hands of various folks as I highly doubt the authors were the first to find this glaring security issue, they’re likely only the first to disclose it. If McKinsey has hard data that nobody else exploited this now would be a good time to disclose that given what sounds like an extremely severe data leak.

The chat messages are very very sensitive. You could easily reverse engineer nearly every ongoing Mck engagement. The underlying data is not as sensitive, its decades of post-mortems, highly sanitized. No client names, no real numbers.
Post reply on HN