Tech and Humanity
When Consultants Get Consulted: What McKinsey’s Two-Hour AI Breach Says About Real Cost of Moving Fast
Published
1 month agoon
By
Eric
By Folu Adebayo
The firm that teaches the Fortune 500 how to deploy AI safely just learned, in 120 minutes, that it had not been listening to its own advice.
On the evening of February 28, 2026, an autonomous AI agent built by a little-known security firm called CodeWall was pointed at the open internet and given a single instruction: pick a target and probe it. It chose McKinsey & Company. Two hours later, the agent had read-and-write access to Lilli, the consulting giant’s internal generative AI platform the very system that 72% of McKinsey’s 43,000 employees use daily, that processes more than half a million prompts a month, and that the firm has been quietly using as a showcase for clients buying its AI advisory services.
The damage surface, when finally disclosed in March, was almost theatrical in its scale: 46.5 million chat messages, 728,000 sensitive file names, 57,000 user accounts, and most consequentially 95 system prompts, the behavioural DNA that governs how Lilli answers every question put to it.
The exploit? SQL injection. A class of vulnerability first documented in 1998. A bug so old it predates the iPod.
This is not a story about a clever hack. It is a story about what happens when the most sophisticated buyers of technology in the world build AI systems with the same architectural assumptions they used to build CRM portals. And it is, more than anything, a warning about the next twenty-four months.
How It Happened
Strip away the mystique and the attack is almost embarrassingly readable. The CodeWall agent began with what every attacker now begins with: reconnaissance. Lilli’s API documentation was publicly accessible. Of the 200-plus endpoints it described,
22 required no authentication at all wide-open doors into a production system. The agent walked through them.
From there, the agent identified an injection vector that standard scanners do not test for: while user values in SQL queries had been parameterised correctly (the textbook defence), JSON field names were being concatenated directly into queries without sanitisation. When the agent began malforming those field names, the database obligingly returned error messages laced with live production data. Classic error-based SQL injection but found by a machine, in minutes, at a cost measured in dollars rather than person-weeks.
What it found in the database is where this stop being a 1998 story and becomes a 2026 story. Sitting in the same tables as the chat messages were Lilli’s system prompts and RAG configuration the instructions that tell the model how to behave, what to cite, what to suppress, what to recommend. With write access, an attacker could silently rewrite those prompts. No code deployment. No release notes. No application log entry. The next morning, 30,000 consultants would log in and receive subtly altered advice and neither they nor McKinsey would know.
The Architectural Failures Were Not Exotic,
They Were Cultural
Engineers will, rightly, list the technical flaws: missing authentication, unsafe string concatenation, no Web Application Firewall on ingress, no schema validation at the gateway, no segregation between AI configuration and application data, no defence in depth.
But the deeper failure is architectural philosophy. Three assumptions, broadly held across the enterprise AI build-out, all wrong:
First, the assumption that AI platforms are just “another web app.” They are not. A traditional database compromise steals data. An AI configuration compromise corrupts judgement at scale, invisibly, for as long as nobody notices. The threat model is fundamentally different.
Second, the assumption that scanners and pen-test cycles will catch what matters. The CodeWall agent did not exploit a novel vulnerability, it exploited an unusual location for an old vulnerability that human red-teamers and OWASP ZAP both routinely miss. Scanners are pattern-matchers. AI attackers are explorers.
Third, the assumption that the application code is where security lives. Application code will always have bugs. Defence in depth means policy enforcement at the infrastructure layer the gateway, the WAF, the network sits independently of, and in front of, the inevitably buggy app. Lilli had none of that.
The Governance Implications Are Larger Than McKinsey
For boards, CROs and CTOs, three uncomfortable truths now sit on the table.
System prompts are the new crown jewels. They are corporate IP, behavioural policy, and regulatory artefact rolled into one. Yet most enterprises store them next to chat logs in a single relational database, behind a single auth layer. They should be encrypted at rest, separated from operational data, version-controlled with cryptographic signing, and changes should require multi-party approval the same controls we apply to production database schemas.
Audit trails designed for human attackers are obsolete. A human breach unfolds over weeks and leaves footprints. A machine-speed breach completes before your SIEM has aggregated the morning’s logs. Worse, a configuration breach leaves no footprint at all, the application is doing exactly what its (now-tampered) instructions tell it to. GRC teams must now monitor AI outputs for behavioural drift, not just AI inputs and infrastructure logs.
Asymmetry has flipped. For thirty years the attacker had to find one hole and the defender had to plug all of them a brutal asymmetry, but a known one. Autonomous offensive agents collapse the attacker’s cost curve. CodeWall’s chief executive said the quiet part loud in his post-disclosure interview: AI agents autonomously selecting and attacking targets will be the new normal. Defenders are not yet running AI agents that continuously red-team their own production systems. They will need to.
What Actually Has to Change
Let me be specific, because vague calls for “AI governance” are how we got here in the first place.
1. Treat every AI platform as a privileged application from day one. That means least-privilege data access, scoped retrieval, and segregation of duties between the model, the prompt store, and the knowledge base. If your AI agent has the same database role as your chat history table, you have already lost.
2. Implement defence in depth across the AI execution path. Three independent gates: an HTTP gate (authentication, rate limiting, WAF, schema validation) before any request touches the application; an LLM gate (prompt-injection detection, content policy enforcement, output filtering) between the application and the model; and an agent gate (tool-call authorisation, scope limits, behavioural monitoring) for any system that lets the AI take actions. None of these can live inside the application code itself.
3. Mandate AI-specific threat modelling before deployment. STRIDE was designed for a world of forms and CRUD operations. It does not catch prompt injection, indirect data exfiltration via RAG, system prompt manipulation, or context poisoning. Your security review template needs an AI-native section. If your CISO cannot describe how your organisation tests for these, that is a board-level finding.
4. Monitor outputs for behavioural drift. Build expected-output baselines. Sample responses continuously. When the AI starts citing a new domain, recommending a new vendor, or suppressing a category of advice, somebody needs to know in hours not when a journalist calls.
5. Make AI configuration changes a board-visible control. System prompts are policy. They should be versioned, signed, dual-authorised, and reportable. The audit committee already reviews changes to the financial close process; it should review changes to the instructions governing the AI tools that influence client-facing work.
6. Run continuous, autonomous red-teaming against your own AI estate. If the threat is now an AI agent that probes endlessly at machine speed, the defence has to be an AI agent that audits endlessly at machine speed. Annual pen tests are not a control; they are a compliance ritual.
The Real Lesson Is About Trust
The most chilling sentence in the entire CodeWall disclosure is the one nobody is quoting. The researchers noted that, having gained write access, they could have rewritten Lilli’s prompts to subtly steer the advice given to McKinsey’s consultants and through them, to clients running critical infrastructure, treasuries, and public services across the world. They chose not to.
We will not always be that lucky.
The McKinsey breach is not really a story about SQL injection. It is a story about how quickly the asymmetry between attackers and defenders has shifted, about how recklessly we have built AI systems that mediate professional judgement at scale, and about how unprepared most enterprise governance frameworks are for a world in which the most sensitive thing inside the firewall is no longer the data, but the instructions that shape how that data becomes advice.
The firms that will earn the right to be trusted with AI in the next decade are not the ones moving fastest. They are the ones who recognise, before the breach disclosure email arrives, that an AI platform is not a productivity tool. It is a piece of decision-making infrastructure and infrastructure has to be governed accordingly.
McKinsey will recover. The next firm may not.
Folu writes on AI governance, Strategy and architecture. Folu is the founder of AIExpertsPro, advising boards and executive teams on AI risk, security and assurance.
Related
You may like
Tech and Humanity
Tech and Humanity: The Long Walk to School
Published
2 days agoon
June 8, 2026By
Eric
By Folu Adebayo
I have not been able to stop thinking about the children of Oyo state.
On the fifteenth of May, gunmen came to three schools near Ogbomoso. They took dozens of pupils, some as young as two years old, and seven of their teachers. One of those teachers, a mathematics teacher named Michael Oyedokun, did not come home. He was killed. As I write this, many of the children and their teachers are still not free. A vice principal has appealed from captivity. Mothers are still waiting at windows.
I am not writing this week as anyone other than a mother, and a Nigerian. I have no expertise to offer on this. No framework. No solution. Only the same ache that millions of us are carrying, and a few quiet thoughts I cannot keep to myself.
There is a particular kind of trust a parent places in the world on the morning they send a child to school.
You comb the hair. You straighten the uniform. You press a little money into a small hand. You watch them go through a gate, and you let go. Every parent who has ever done this knows the quiet leap of faith it requires. We are handing the most precious thing we will ever hold to a building, to a teacher, to a community, and we are trusting all of them to give that child back to us at the end of the day.
For the parents of these children, that trust was broken in the most terrible way imaginable.
They did everything right. They sent their children to learn. And the children did not come back.
I keep thinking about how ordinary that morning must have been. The arguments about shoes. The rushing. The half-eaten breakfast. None of them knew. That is the part that undoes me. None of them knew it was that kind of morning.
“They did everything right. They sent their children to learn. And the children did not come back.”
And then there is Michael Oyedokun.
I did not know him. Most of us did not. But I know what he was. He was a mathematics teacher in a rural school, which means he had chosen one of the most quietly heroic lives a person can choose. He got up each day and went to teach children in a place the rest of the country too often forgets. He was not paid much. He was not celebrated. He simply showed up, year after year, and gave children the one thing that could change their lives, which is knowledge.
When the gunmen came, he was there with his students. And he did not come home.
We use the word hero too easily, and usually for the wrong people. But a man who spends his life teaching other people’s children in a forgotten village, and who dies among them, has earned that word completely. Michael Oyedokun was a hero. I want his name written down. I want it remembered. Not as a statistic in a tragedy, but as a man, a teacher, who mattered.
There is something almost unbearable about the fact that this happened at a school.
School is meant to be the safest promise a society makes to its children. It is where we send them to become more than we were.
For generations of Nigerian families, education has been the one ladder out, the thing parents sacrifice everything for, the reason mothers sell their last wrapper, and fathers work themselves into the ground. We tell our children that if they go to school and they learn, the world will open for them.
And so to attack a school is to attack the deepest hope a people hold. It is to tell every parent in the country that the one safe promise is no longer safe. That the ladder out can be taken from you in the time it takes for a truck to arrive.
I do not believe that promise is broken. I refuse to believe it. But I understand the fear of every parent who tightened their grip on a small hand this week and wondered, for the first time, whether the gate they were walking toward was safe.
I have spent much of my life thinking about systems, about technology, about the machinery that runs a modern society. And there is a temptation, in a week like this, to reach for the language of solutions. To talk about what could be built, monitored, deployed.
I am not going to do that. Because no system, however clever, matters more than a society’s simple willingness to protect its children. That willingness is not a technology. It is a choice. It is the most basic test of whether a nation is worthy of the name. Everything else we build, every road and bank and tower and innovation, means nothing if a mother cannot send her child to school and trust that he will come home.
“No system, however clever, matters more than a society’s simple willingness to protect its children.”
So this week I am not offering an argument.
I am offering only this.
To the parents of Oyo still waiting: there is a mother in London who thinks of you when she wakes, and who prays your children are returned to your arms whole and soon. You are not forgotten. The whole country is shouting your children’s names.
To the family of Michael Oyedokun: thank you. The word is far too small. He gave his life among the children he taught, and a grateful stranger will remember his name.
And to every teacher who will still walk into a classroom tomorrow, in a rural village, in a frightened community, knowing what happened in Oyo and going anyway: you are the bravest people in this country. You carry our future on your backs. We see you. We will not forget what it costs you.
May God bring this home soon. And may we become, at last, a nation that deserves the trust those parents placed in us on an ordinary morning in May.
Related
Tech and Humanity
Tech and Humanity: The Day I Built Something Because My Son Needed It
Published
2 weeks agoon
May 30, 2026By
Eric
By Folu Adebayo
This column is usually about boards, regulators, and the governance of artificial intelligence. But this week I want to write about a child.
My son’s name is Akintade. He is autistic. And the journey of getting him to a place where the world saw what I saw that took years longer than it should have.
I want to tell you what that journey was actually like. Because I think most discussions of AI in our newspapers are missing something important and Akintade is the reason I know it.
The years I do not talk about often
When Akintade was young, I knew. Not in any clinical way. I just knew. A mother knows.
I took him to GPs who told me to wait and see. I took him to schools who said he would catch up. I took him to family members who told me I was worrying too much. The system around him was full of patient, well-meaning people. None of them could see what I could see.
The wait for formal assessment in our NHS was years. Years during which he was in a classroom that did not understand him. Years during which I sat in meetings as a senior professional, carrying invisibly the knowledge that something was wrong with my child and the inability to prove it.
I want African mothers reading this to know I see you. Because what I went through in the United Kingdom, you may be going through with even fewer resources, even longer waits, even less understanding from the system around you.
The autism diagnosis journey is one of the loneliest journeys a parent can walk. And it is happening, right now, in Lagos and Abuja and Accra and Nairobi and Kano and Cape Town. To mothers and fathers who watch their children struggle and have no idea where to turn.
“The autism diagnosis journey is one of the loneliest journeys a parent can walk.”
The promise I made
Somewhere in the middle of our journey with Akintade, I made myself a promise.
If I ever got to a place where I could help if my skills and credentials and energy ever amounted to something useful. I would build something so that no parent had to walk that journey alone. Not in the United Kingdom. Not in Nigeria. Not anywhere.
For a long time the promise sat there. Akintade grew. He became the best of himself. He found his strengths. He became the brilliant, particular, wonderful young man he is.
And artificial intelligence developed.
What AI is actually for
This is where we usually pause in this column to talk about governance, risk, regulators, and the corporate implications of artificial intelligence.
Today I want to make a different point.
Artificial intelligence at its best, used carefully and responsibly has the capacity to do something the institutions around us have not always done. It can listen. It can help a parent put words to what they are seeing. It can produce a structured report at three in the morning when there is nobody else to talk to. It can do this in the parent’s own language. It can do this for free.
It cannot diagnose. It cannot replace the clinical professionals our children need.
But it can hand a worried, exhausted, isolated parent something tangible to walk into a GP appointment with.
That is the gap I have built into.
The tool that came from a promise
It is called Neurohelp.ai. The website is www.neurohelp.ai . It is free. It is available in ten languages including Yoruba. It works for any age from eighteen months to adulthood. It carries no advertising and asks nothing of the family using it.
I built it for the mother who knows. The father who is too tired to keep fighting alone. The grandmother holding the baby and wondering why he does not respond to his name. The teacher who suspects something but does not know how to raise it with the parent. The adult who has spent forty years wondering why they are different.
Last week a mother contacted me. She had been on a waiting list in UK for years. She had tried Neurohelp.ai. She had generated a report. She had taken it to her GP. She had finally, for the first time in years ,booked the appointment that might change her child’s life.
She sent me a message saying thank you. She told me she had cried while typing it. She said I deserved an MBE for what the tool had done for her family.
And I cried too.
Because for a moment, I felt the promise I made years ago land in the world.
“The value of AI is not measured in boardrooms. It is measured in a single mother finally having the words to describe her child.”
Why I am writing this in a business column
I am writing this in a column about AI because I want African business leaders, technologists, regulators, and entrepreneurs reading this newspaper to understand something.
Artificial intelligence is not just a tool for productivity. It is not just a competitive advantage. It is not just a regulatory headache.
It is one of the most important opportunities Africa has ever had to close the gaps that the institutions around us have not yet closed for children with autism, for mothers in rural areas, for adults navigating diagnoses, for communities historically underserved.
If you are building AI in Africa, build it for them. If you are funding AI in Africa, fund the founders building it for them. If you are governing AI in Africa, make space for the small, mission-driven tools that do not have venture funding but do have purpose.
Because the value of AI is not measured in the boardrooms of Silicon Valley or the regulatory texts of Brussels. It is measured in a single mother in Lagos finally having the words to describe her child’s experience. It is measured in a GP appointment booked. It is measured in a family no longer alone.
The work continues
Akintade is now a young man. He inspires me daily.
Neurohelp.ai is the tool I built because I love him. Akintade Autism Centre is the work I do because I want every family to feel the support that I have. The charity Autism Treatment Support Initiatives UK registered, is the structure that makes that work sustainable.
I share this not as a promotion. I share it because the journey from one family’s pain to a tool that can help thousands is exactly the kind of journey African AI can lead the world on.
If you know a family on a waiting list, share Neurohelp.ai with them today.
If you are a parent reading this who is carrying invisible weight at work and at home , I want you to know you are seen. You are not alone. And the work you are doing for your child matters more than almost anything else in this world.
The day I built Neurohelp.ai was the day I kept a promise I made to myself in the darkest part of our journey.
Africa’s AI moment can be a thousand kept promises. To a thousand families. In a thousand languages. Free of cost. Built with love.
That is what AI is actually for.
Related
Tech and Humanity
Tech and Humanity: The Tribunal Ruling That Should Change How Africa Thinks About AI
Published
3 weeks agoon
May 23, 2026By
Eric
By Folu Adebayo
A lawyer in the United Kingdom needed to summarise a confidential client document. Forty pages. A busy day. So they did what millions of professionals around the world now do without a second thought.
They pasted it into an AI tool.
Faster than reading it line by line. Nobody had told them not to. Nobody had told them they could. There was no policy. No training.
No record of the decision.
It seemed harmless. It was not.
A UK tribunal has now ruled that uploading confidential documents to an AI tool can be treated as the equivalent of placing them in the public domain. The legal privilege protecting those documents, the confidentiality that is the very foundation of the relationship between a professional and their client was lost. Permanently.
Not because anyone acted in bad faith. Because the tool did what such tools do the moment information is entered into them.
“The employee was not trying to do anything wrong. They were trying to work faster.”
Why this matters far beyond the United Kingdom
It would be easy for African business leaders to read this as a distant story. A British tribunal. A British case. A British problem.
That would be a mistake.
The behaviour at the centre of this ruling a professional pasting confidential information into an AI tool to save time is happening in every law firm, every bank, every hospital, every government office, and every consultancy in Lagos, Nairobi, Accra, and Johannesburg right now. Today. As you read this.
The technology does not respect borders. The behaviour does not respect borders. The risk does not respect borders.
The only thing that varies from country to country is whether there is a governance framework in place to manage it and whether the people using these tools have been told, clearly, what is and is not permitted.
In most African organisations, that framework does not yet exist.
The quiet leak
Consider what is most likely happening inside your own organisation as you read this.
A member of staff has a long report to summarise. They paste it into a free AI tool.
A colleague is drafting a difficult email and asks an AI assistant to improve the wording including the confidential context. Someone in finance uploads a spreadsheet of sensitive figures to ask the AI to analyse it. A junior employee, eager and capable, uploads a client contract to extract the key terms quickly.
None of these people are acting maliciously. Every one of them is trying to do their job well.
And every one of them may be moving confidential information client data, commercial secrets, personal information, privileged material outside the protected boundary of the organisation.
This is not a hypothetical risk. Industry research suggests that the overwhelming majority of organisations have employees using AI tools, while only a small minority have any policy governing what may be entered into them. The gap between adoption and governance is not narrowing. It is widening.
“The technology does not respect borders. Neither does the risk.”
Why Africa is particularly exposed
There are three reasons this risk is especially acute across African markets.
First, AI adoption across Africa has been rapid, mobile-first, and largely informal. Professionals have embraced AI tools with energy and ingenuity often ahead of the organisations they work for. That is a strength. But it means usage is running far ahead of governance.
Second, many African organisations do not yet have the data protection infrastructure, the internal compliance functions, or the governance frameworks that would, in other markets, provide at least some guardrails. The legal frameworks are developing , Nigeria, Kenya, Ghana and South Africa have all made significant progress on data protection but the translation of law into day-to-day organisational practice remains incomplete.
Third, the consequences of a confidentiality breach are severe in any market, but in markets where trust is hard-won and reputational damage spreads quickly, the cost can be existential. A bank that leaks customer data, a law firm that loses privilege over client documents, a hospital that exposes patient information these are not recoverable inconveniences. They are breaches of the trust on which the entire business depends.
What African leaders must do now
The good news is that the solution is neither expensive nor complex. It does not require new technology. It requires leadership, clarity, and a small amount of disciplined effort.
First, establish a clear AI usage policy. A single, plain-language document that states what types of information may and may not be entered into AI tools. It does not need to be sophisticated. It needs to exist, and it needs to be communicated.
Second, train your people. Not a lengthy programme a clear, honest conversation. Most employees who create AI-related risk do so because nobody has explained the danger to them. Once they understand, the overwhelming majority adjust their behaviour immediately.
Third, create a record. The UK tribunal ruling makes clear that when accountability is tested, organisations will be expected to demonstrate that their people understood the rules. A simple, dated record showing that staff have received and acknowledged the AI usage policy is no longer an administrative nicety. It is a protection.
Fourth, lead by example. When senior leaders talk openly about responsible AI use, it gives everyone else permission to ask the questions they are currently afraid to ask.
The opportunity inside the warning
It would be easy to read this column as a reason to fear AI, or to restrict it. That is not my intention.
AI is one of the most powerful tools African professionals have ever had access to. It can close capability gaps, accelerate work, and allow small organisations to compete with much larger ones. The answer is not to ban it. The answer is to govern it.
The organisations that will thrive in the African AI economy are not the ones that move fastest or the ones that move most cautiously. They are the ones that move deliberately adopting AI with energy, and governing it with discipline.
The UK tribunal ruling is a warning. But it is a warning delivered early enough to act on. African leaders who read it, understand it, and act on it now will protect their organisations, their clients, and their reputations.
Those who treat it as someone else’s story will learn the same lesson later and at a far higher price.
The choice, as always, belongs to leadership.
Folu is AI Architect & Risk & Governance Director, United Kingdom, Founder of AIExpertsPro, and an AI governance advisor to UK and African financial institutions, and can be reached via aiexpertspro.co.uk/folu@aiexpertspro.co.uk
Related


When Architecture of Policy Meets Architecture of Connection
Statement on the State of the Nation by Some Concerned Nigerians
Why Dele Momodu May Be Atiku’s Smartest Running Mate Option Yet
Dele Momodu: The Bridge Between Politics and the People
The Bridge Nigeria Needs: Reflections on Leadership, National Unity, and the Ati-Dele Conversation
UBA Foundation Marks World Environment Day 2026 with Tree-Planting Initiative
The Search for Justice: ADC vs Tsoho
Packed Centres and Penalty Heartbreak: How UCL Final Captured the City’s Imagination
Friday Sermon: Terrorism: The Curse of Islam 1
Nigeria’s Persistent Insecurity Challenge and It’s Stark Realities
How We Rescued Adelabu’s Sister and Her Twin Sons from Kidnappers – Police
The Trials of Leadership in National Security: Lessons, Challenges and Enduring Solutions
First Lady’s Cars Distribution to APC Women Amid Oyo Kidnapping Crisis, Outrage or Applause?
Lessons from 2019, 2023 Elections: Why Atiku Abubakar Needs Dele Momodu As Running Mate
Trending
-
Opinion3 days agoPacked Centres and Penalty Heartbreak: How UCL Final Captured the City’s Imagination
-
Islam5 days agoFriday Sermon: Terrorism: The Curse of Islam 1
-
Opinion5 days agoNigeria’s Persistent Insecurity Challenge and It’s Stark Realities
-
Featured3 days agoHow We Rescued Adelabu’s Sister and Her Twin Sons from Kidnappers – Police
-
Opinion4 days agoThe Trials of Leadership in National Security: Lessons, Challenges and Enduring Solutions
-
Featured3 days agoFirst Lady’s Cars Distribution to APC Women Amid Oyo Kidnapping Crisis, Outrage or Applause?
-
Opinion2 days agoLessons from 2019, 2023 Elections: Why Atiku Abubakar Needs Dele Momodu As Running Mate
-
Events4 days agoOlowoporoku Celebrates Transformation with Unveiling of Two Inspirational Books

