Bain & Co AI Tool Breached by Hacker, Exposing Client Conversations A hacker known as CodeWall accessed Bain & Company’s internal AI platform, Pyxis, just weeks after exposing vulnerabilities in rival consultancy McKinsey’s systems. The breach, disclosed on Monday, revealed nearly 10,000 AI-driven conversations between Bain staff and clients, including queries from consumer food brands analyzing competitors. CodeWall claimed it took just 18 minutes to exploit a weakness credentials embedded in publicly available web code allowing access to employee email addresses and security tokens. The hacker suggested this could enable impersonation of Bain employees or creation of new Pyxis accounts. Bain stated it resolved the issue quickly with external cybersecurity support, adding that Pyxis operates independently of its core client systems and does not store proprietary data. The firm disputed CodeWall’s characterization of the breach’s scope. This incident follows a similar breach at McKinsey last month, where CodeWall identified flaws in an in-house AI tool, and a separate vulnerability at Boston Consulting Group (BCG) earlier this month. BCG confirmed the issue was remediated within hours, affecting only an isolated data warehouse with anonymized, public data. The breaches highlight risks in the rapid adoption of AI by elite consulting firms, which are increasingly advising clients on AI integration. Bain has partnered with Andrew Ng and Palantir to expand its AI advisory services, while BCG projects 40% of its 2026 revenue from AI-related work. CodeWall’s founder, Paul Price, targeted these firms due to their high-profile AI initiatives, suggesting that fast-paced development may outpace security testing. The incidents underscore the growing cybersecurity challenges in AI-driven business tools.