A special topic episode covering the most consequential AI platform security incident disclosed to date — now updated with state-sponsored threat context and NDAA policy deadlines.

On March 9th, 2026, an autonomous offensive security agent compromised McKinsey's internal AI platform Lilli in approximately two hours. The entry vector was SQL injection — a vulnerability class from the 1990s — through 22 unauthenticated API endpoints. No credentials were used. No zero-day exploits were required.

What was exposed: 46.5 million chat messages in plaintext. 728,000 files including strategy documents and M&A analysis. 57,000 user accounts. 3.68 million RAG document chunks with S3 storage paths. And 95 writable system prompts across 12 model types — the ability to silently alter AI behavior flowing to approximately 40,000 consultants without any code deployment.

This episode walks through the full attack chain, gives the skeptical view fair treatment (including security analyst Edward Kiledjian's detailed critique), maps the incident to OWASP Web Top 10, OWASP LLM Top 10, NIST AI RMF, and ISO 42001 controls, and provides a seven-point enterprise AI security checklist.

New in this edition: how the same elementary vulnerabilities that enabled the Lilli breach are being exploited by state-sponsored actors — Iranian APT groups integrating AI into offensive operations, the Stryker wiper attack, AWS data center drone strikes during Operation Epic Fury, and FY2026 NDAA AI governance deadlines including the April 1st AI Futures Steering Committee.

This is one of more than 20 documented AI platform security incidents since January 2025. The pattern is consistent: the AI is new, the security failures are not.

27 sources cited. Full source list in show notes.

AI Disclosure: This episode was produced with AI assistance. Research synthesis and script writing used Claude (Anthropic) under human editorial direction. Audio narration by Microsoft Edge TTS (en-US-AndrewNeural voice).

When AI Hacks AI — The McKinsey Lilli Breach and What It Means for Enterprise AI Security