Forgot your password?
typodupeerror

Submission + - How An Autonomous Agent Got Full Read/Write of McKinsey's Internal AI Platform (codewall.ai)

indros13 writes: McKinsey & Company — the world's most prestigious consulting firm — built an internal AI platform called Lilli for its 43,000+ employees.

So we decided to point our autonomous offensive agent at it. No credentials. No insider knowledge. And no human-in-the-loop. Just a domain name and a dream. Within 2 hours, the agent had full read and write access to the entire production database.... This wasn't a startup with three engineers. This was McKinsey & Company — a firm with world-class technology teams, significant security investment, and the resources to do things properly. And the vulnerability wasn't exotic: SQL injection is one of the oldest bug classes in the book. Lilli had been running in production for over two years and their own internal scanners failed to find any issues.


Comment Yep (Score 1) 186

The UHF app on our Apple TVs & iOS devices and the UHF Server in Docker to act as a PVR gives us everything for a few $ a month paid in crypto.
We haven't had cable since ~1999-2000. Downloading and the *arrs have kept us happy, but the better half wanted to check out some live sports. So IPTV it was.

Comment Re:Calling it a lead is very generous (Score 1) 28

I've used Claude at home for ages. Work was wanting to get some AI stuff for us and the only 'blessed' one is CoPilot. Everything else it blocked. All senior management seems to know about AI is "Hurrr... Copilot and ChatGPT."

Out team of ~8 (pentestesting & VA) were unanimous about Copilot being crap and Claude being the top dog. So some higher ups OK'd a Claude Teams package for work. To bypass the CorpSec tards, we use it from our lab environment that has its own unmonitored link and IP range.

Anthropic/Claude is just so far ahead of OpenAI/ChatGPT and MS/Copilot it's not funny.

Slashdot Top Deals

God may be subtle, but he isn't plain mean. -- Albert Einstein

Working...