CodeWall broke McKinsey, BCG and Bain — then raised $4M
Two halves of the agent economy landed in the same hour: a startup that pointed autonomous attackers at three of the world's most prestigious employers, and two small rounds betting agents can absorb the unglamorous work nobody ever wrote down.
CodeWall came out of stealth today with $4 million — and a calling card it earned months ago, when its agents broke McKinsey, BCG and Bain before the company had launched. The London offensive-security startup's agents start with no credentials, no source code and no inside access, work in parallel, and log every discovery to a shared investigation graph so a soft endpoint in one system becomes a route into the next. The McKinsey job is the one on the record: The Register reported in March that an agent reached full read and write access to the production database behind Lilli, the firm's internal AI assistant, within two hours, arriving through 22 unauthenticated API endpoints — one of which concatenated JSON keys straight into SQL. By CodeWall's count, that included 46.5 million strategy and M&A chat messages, 728,000 files, 57,000 user accounts and 95 system prompts in plaintext, with write access to the prompts that shape every answer Lilli gives. McKinsey says a third-party forensics firm found no evidence client data was accessed. The BCG numbers are more brutal: an unauthenticated query endpoint on x.bcg.com exposing 3.17 trillion rows and 131.2 terabytes of workforce, compensation and transaction data, write privileges included, fixed within 48 hours of disclosure. BCG declined to comment, per CodeWall's own write-up; the Bain breach, by the firm's account, came through hardcoded credentials in a public JavaScript file in 18 minutes.
The uncomfortable part is not the intrusion — it is the sales pitch. "We used a specific AI research agent to autonomously select the target," founder and CEO Paul Price told The Register, with no human input. The same automation that let a pre-launch startup case three consultancies is available to people with worse intentions, and CodeWall's product is a permanent attacker rather than an annual pen test. Osney Capital led the pre-seed, with InReach Ventures, Antler and angels participating.
Evos raised $9 million in pre-seed funding to teach agents a job by watching the person who already knows it. Each operator starts behind an approval gate: it observes decisions, humans accept or correct them, and those corrections become training data until the operator's calls consistently match the team's — at which point it is allowed to work unsupervised. The New York company, officially Evolutionary Operating System Inc., says it passed $1 million in annual recurring revenue four weeks after going live, and freight brokerage MyFreightWorld has made nearly 3,500 LTL carrier invoice audit decisions at 97% accuracy against its transportation management system. Uncork Capital and Field Ventures co-led, with Crosslink Capital, Utopia Capital Management and Sandwith Ventures joining. Its Workhorse platform formally launches in the coming weeks.
Uvi raised $7.5 million to stop every new agent relearning your company from scratch. The Connecticut company, legally Naboo Research Ltd., builds a context layer that maps how Slack threads, Jira tickets, code repositories, meeting minutes and CRM records relate to one another, and carries user permissions with the data so a departed employee's access does not resurface through an agent. It is selling a cost story: agents without that layer run $0.75 to $1.41 per response by the company's own benchmarks — sometimes past $2 — against 10 to 16 cents when they route through it, and up to 46 times cheaper on open-ended questions. CT Innovations led the seed, with Cardumen, Mana VC and 91 Ventures participating; Monday.com, Lemonade and Melio are among the customers.
What to watch: whether any of the three consultancies treats the CodeWall findings as a disclosure event. Remediation happened quietly in hours, but the BCG endpoint sat in front of 131 terabytes of licensed third-party data whose suppliers will eventually want an accounting.
If an autonomous attacker becomes a standard line item in the security budget, who carries liability when it finds something real — the vendor, the buyer, or the model? Tell us in the comments.
