46.5M
private conversations read by one agent, in ~2 hours
In early 2026, an autonomous AI agent broke into McKinsey’s internal AI platform in about two hours. It didn’t crack a password. It reasoned its way in.
The agent that entered McKinsey’s Lilli platform accessed 46.5M private conversations about strategy, mergers, and client deals. It extracted 728K internal files and compromised 57K employee accounts. It also gained write access to the 95 system instructions that govern how the AI thinks. No software vulnerability was exploited. The agent found gaps in access logic and walked in.
The firewalls didn’t fail. The assumptions did. IT controls were built for software that executes. AI reasons — and that difference produces a class of risk your existing framework was never designed to see:
When a database fails, it stops. IT risk is deterministic — you can test whether a query returns the right result, and a failure throws an error somebody sees.
When an AI fails, it keeps running — producing plausible, wrong output. AI risk is probabilistic. It can get the wrong answer a thousand times before anyone notices.
The AI gets quietly worse as the world changes. Software doesn’t decay on its own; a model’s accuracy can slide for months with no error thrown.
Agents send, update, and approve. A wrong action executes across systems at machine speed — and RBAC governs users, not multi-step agent workflows.
Corrupt the training or retrieval data and the model is compromised at its core. There is no patch — only retraining.
HIPAA, GDPR, and SOC 2 assume humans decide and can explain why. AI compliance is about reasoning, not just access logs.
“The agent did it” — so who’s responsible? Model, data, agent, and oversight blur where software had a clear chain.
Confident, well-formatted, and wrong. Software fails loudly; AI fails fluently — as illustration, 1–2% of 100K monthly interactions is 1,000–2,000 wrong answers.
Every prompt, response, and tool call is an endpoint, and each is a door for these six. Private infrastructure collapses dozens of vendor endpoints to one boundary the customer owns: models run on NetApp® storage, the customer decides when they retrain, and Iterate’s AgentWatch logs every agent action — with human approval on risky steps and an audit trail the customer owns.
Treated like IT, these six surface as violations and quiet damage. Governed as their own class, they become a checklist you can actually run.
On what AI memory holds: The Oohs, Awes, and Dangers of AI Memory. The attacker’s view: Five Doors Into Your AI’s Memory (companion). Full series — iterate.ai/partners/netapp/papers.
A joint educational series on private AI and the AIPod Mini. NetApp — the governed data-control layer. Iterate.ai — the private intelligence layer.
