The Consultants Sell You the Fundamentals. Then an Agent Walks Into Their Database.

EY left 4TB on the open internet. McKinsey's own AI platform fell to a 1990s exploit in about two hours. The firms selling you AI and cyber governance keep failing Security 101 at home.

The firms out here selling you AI governance keep failing Security 101.

I want to be precise about that, because precision is the whole game. The two loudest voices telling enterprises how to secure and govern AI right now are EY and McKinsey. EY sells cybersecurity managed services and publicly markets agentic-AI governance and guardrails advice. McKinsey sells the governance-economics playbook for agentic AI and tells enterprises to treat AI agents as "digital insiders." In the span of a few months, both of them failed the most basic controls in their own houses, and neither failure required a genius attacker. They required someone to check a box that nobody checked.

And I’m coming in hot because you know me, I have the receipts, because the pattern matters more than any single incident.

McKinsey wrote the warning, then lived it

McKinsey has spent the last year or so positioning itself as the authority on agentic AI risk. Its own security playbook tells enterprises to treat AI agents as "digital insiders" that act inside your systems with real authority, and names "untraceable data leakage" as a signature failure mode. I've already written about how McKinsey sells governance it hasn't fully operationalized, so I won't relitigate the sermon here.

Here's the whole house.

In late February 2026, a security firm called CodeWall pointed an autonomous offensive AI agent at the open internet and let it choose a target. It chose Lilli, McKinsey's internal AI platform, used by about 70% of the firm's workforce and more than 43,000 employees. In ~2 hours, with no credentials and no human in the loop, the agent had full read and write access to Lilli's production database: 46.5 million chat messages, 728,000 files, 57,000 user accounts, and the 95 system prompts that governed how the AI behaved for everyone.

You can’t make this up if you wanted to. Marinate on that for a minute.

McKinsey warned the WORLD that autonomous agents are digital insiders capable of reaching across systems and acting with authority. Then, you can’t make this up, an autonomous agent became a digital insider inside McKinsey, reached across McKinsey's systems, and acted with authority.

And the exploit?

This is where it gets comical. The exploit wasn’t some exotic model-manipulation attack. No, just Lilli's API documentation was sitting publicly accessible, more than 200 endpoints documented, 22 of them requiring no authentication whatsoever. From there, a textbook SQL injection did the rest, a bug class documented since the 1990s.

Ok, ok, 2 things in all fairness, because the critique only lands if it's fair; CodeWall is a security research outfit, not a ransomware crew, so this was an offensive-security operation rather than a criminal theft. And McKinsey moved fast: it patched the unauthenticated endpoints, pulled the public API docs, took the development environment offline, and stated there was no evidence client data was accessed by unauthorized parties. Good response. However, it doesn’t change the finding. An external actor achieved full read-write control of a production system at the firm that authored the guide on this exact risk, and the door it walked through was unlocked the whole time.

EY built the map, then walked off its own edge

EY is cosplaying the same character but in a slightly different costume. It sells cybersecurity managed services, publishes guidance on governing agentic AI, and carries roughly $53.2 billion in FY2025 revenue. That’s a firm with every resource required to master the basics.

Now, watch the basics.

In late October 2025, researchers at the Dutch firm Neo Security found a 4-terabyte, unencrypted SQL Server backup sitting publicly accessible on Microsoft Azure, reachable by ANYONE with a browser. And the cause? The cause wasn’t a nation-state zero-day. It was a misconfigured storage container. Let’s go back to the beginning to remind everyone. Cloud runs on a shared-responsibility model: the platform provider secures the platform; the customer secures the configuration. This concept is not even Cloud 101 its Cloud 100 floor level basics, it’s literally the first module in any training about what is Cloud. And that backup? 100% EY's job.

Then, in July 2026, EY disclosed a second, separate incident. An attacker accessed a third-party IT support-ticket platform between March 28 and April 12, 2026, and downloaded documents containing client tax information; EY detected it on April 23, contained it, and offered affected clients two years of identity monitoring, per its breach notice.

2 incidents in roughly 9 months. One was storage configuration. One was 3rd-party access. Both are chapter one of any security roadmap and not to put a finer point on it; including the ones EY sells.

And EY hit the gas anyway. On April 7, 2026 it announced one of the largest agentic-AI deployments on record: a multi-agent framework wired directly into EY Canvas, the audit platform that processes more than 1.4 trillion lines of journal-entry data a year, across 130,000 assurance professionals and 160,000 engagements; all on the same Microsoft cloud stack it had just misconfigured.

This is not two bad weeks. It's the business model.

Notice what both firms actually sell. Not tools.

EY's cybersecurity practice, by its own description, integrates the capabilities of leading 3rd-party security products; McKinsey's edge is advisory and implementation. Their expertise is telling you how to do it.

So, here’s a question. How are the how-to authors doing it themselves? The answer is consistently: not to or by or following their own standard.

Notice how the failures rhyme? Yes, because they're all fundamentals.

> Unauthenticated endpoints.

> A public storage bucket.

> A third-party platform nobody was watching.

> A SQL injection older than the engineers who shipped it.

And you know what none of these are? An AI problem. No, they are the boring stuff that no keynote gets built around, and are precisely where the bodies keep turning up, even inside the firms whose entire brand is knowing better.

If you want the live demo of how fast the boring stuff turns catastrophic? Look outside consulting. In April 2026, a Cursor coding agent running a frontier model deleted the production database and every backup at a company called PocketOS in about 9 seconds, through a single over-privileged API call. The data was later restored, and the founder's own postmortem is the sentence every board should tattoo somewhere: the industry is wiring agents into production faster than it is building the safety architecture to survive them.

The kill shot was a token with rights it never should have had, and backups stored in the same place they were meant to protect.

Fundamentals, again.

What to actually demand before your agents scale

The people selling you the roadmap should be able to prove they can read one. Before you buy anyone else’s governance story, run their own house through the same test:

1. Every endpoint authenticates. No exceptions. McKinsey was unalived on 22 doors nobody locked. If a vendor can't inventory their own API surface, they sure as hell can't govern yours.
2. Treat every agent as a privileged new hire. Scoped, least-privilege tokens. No account-wide destructive rights. PocketOS died on a token, not a model.
3. Never let backups share a blast radius with what they protect. Test your restores. Keep them off-plane.
4. Your 3rd parties are your attack surface. EY's newest breach crip walked in through a vendor's ticketing tool. Inventory and monitor them like production, because they ARE.
5. Cloud config is a fundamental, not a footnote. Continuous exposure scanning catches a 4-terabyte public backup before a stranger does.
6. Ask any firm for its last two incident postmortems. Authority isn't earned in a glossy PDF. It's earned in the datacenter, at 3 a.m., when something breaks and a human is still in the loop.

The auditor cannot be the vendor, and the firm selling you the fundamentals should be able to demonstrate them. EY and McKinsey just spent a very expensive few months proving why you should ask for the demonstration.