




GFI Software
18.9K posts

@GFISoftware
We are committed to delivering trusted expertise, rightly sized, and smartly engineered IT solutions to SMBs worldwide.








The Google Threat Intelligence Group has detected the first known instance of a threat actor using an AI-developed zero-day exploit in the wild. While the attackers planned a wide-scale strike, our proactive counter-discovery may have prevented that from happening. This finding is part of our new report on AI-powered threats.































McKinsey’s internal AI tool “Lilli,” used by around 45,000 employees, was reportedly breached by CodeWall’s AI agent in under two hours. According to CodeWall, the issue came from exposed API documentation and unauthenticated endpoints, which led to read-write access to a database containing confidential chat messages, client files, and user accounts stored in plain text. McKinsey says it was informed, investigated with a third party, found no evidence of other access, and patched the issue. The bigger point: if a firm like McKinsey can miss basic security controls in an internal AI system, every company rolling out AI for critical business work should re-check what they may be exposing.

