Mercor confirms supply chain attack as Meta pauses work over AI training data exposure risks

Mercor Confirms Security Breach Linked to LiteLLM Supply Chain Attack

Mercor, the $10 billion AI recruiting startup, has confirmed it was "one of thousands of companies" affected by a security breach tied to a supply chain attack on the open-source library LiteLLM1

1

. The company, which generates AI training data for major tech firms including Meta, OpenAI, and Anthropic, disclosed the incident on March 31 after extortion hacking group Lapsus$ claimed responsibility for stealing approximately four terabytes of data from the startup2

2

. Mercor spokesperson Heidi Hagberg stated the company had "moved promptly" to contain and remediate the security incident, with a thorough forensics investigation now underway supported by third-party experts5

5

.

Founded in 2023 by three former high school debate teammates, Mercor facilitates more than $2 million in daily payouts and reached $500 million in annualized revenue by September 2025, up from $100 million just six months earlier4

4

. The company closed a $350 million Series C round led by Felicis Ventures in October 2025, valuing it at $10 billion and making its founders the world's youngest self-made billionaires at age 221

1

.

TeamPCP Exploits Open-Source Vulnerability Through Malicious Code

The breach originated from a sophisticated attack by hacking group TeamPCP, which compromised the CI/CD pipeline of LiteLLM, a Y Combinator-backed open-source library downloaded millions of times per day according to security firm Snyk1

1

. On March 27, 2026, TeamPCP published two malicious versions of the LiteLLM package—1.82.7 and 1.82.8—directly to PyPI, the Python package repository4

4

. The tainted packages remained available for approximately 40 minutes before being identified and removed.

The payload was designed to harvest environment variables, API keys, SSH keys, cloud credentials across AWS, Google Cloud, and Azure, Kubernetes configurations, CI/CD secrets, and database credentials4

4

. TeamPCP had previously compromised Trivy, a widely used vulnerability scanner, to obtain credentials belonging to a LiteLLM maintainer, which they then used to execute the attack4

4

. This represents part of a larger supply chain hacking spree by TeamPCP that has gained momentum in recent months, with the group also targeting Checkmarx's KICS tool and reportedly breaching Cisco's internal development environment3

3

.

Meta Suspends Work as AI Industry Secrets Face Exposure

Meta has indefinitely paused all work with Mercor while investigating the breach, two sources confirmed to WIRED2

2

. Contractors staffed on Meta projects, including the Chordus initiative designed to teach AI models to use multiple internet sources to verify responses, cannot log hours until the project resumes, effectively leaving them without work2

2

. OpenAI confirmed it is investigating how its proprietary AI training methodologies may have been exposed, though the company stated the incident does not affect OpenAI user data2

2

.

What makes this breach particularly alarming for AI labs is not just the personal data exposure affecting more than 40,000 contractors and customers, but the potential compromise of proprietary training protocols4

4

. Because Mercor sits inside the data pipelines of multiple AI companies simultaneously, the breach may have exposed details about data selection criteria, labeling protocols, and training strategies that companies have spent billions developing. These AI industry secrets represent genuine competitive advantages that labs like Meta, OpenAI, and Anthropic have worked to keep confidential, as they reveal key details about how they train models powering products like ChatGPT and Claude2

2

.

Data Exfiltration Scale and Lapsus$ Extortion Claims

Lapsus$ claimed on its leak site to have obtained four terabytes of data, including 939 gigabytes of source code, a 211-gigabyte user database, and approximately three terabytes of video interview recordings and identity verification documents4

4

. The group shared samples allegedly taken from Mercor that included Slack data, ticketing information, and two videos purportedly showing conversations between Mercor's AI systems and contractors on its platform1

1

. However, security researchers note that many cybercriminal groups now periodically adopt the Lapsus$ name, and Mercor's confirmation of the LiteLLM connection suggests the actual attacker is likely TeamPCP or an actor connected to that group2

2

.

According to Allan Liska, an analyst at security firm Recorded Future who specializes in ransomware, "TeamPCP is definitely financially motivated. There might be some geopolitical stuff as well, but it's hard to determine what's real and what's bluster, especially with a group this new"2

2

. Wiz researchers indicated they "saw indications in Cloud, Code, and Runtime evidence that the credentials and secrets stolen in the supply chain compromises were quickly validated and used to explore victim environments and exfiltrate additional data"3

3

.

Widespread Impact Across AI Supply Chain

Mercor may be merely the first downstream company to publicly confirm victimization, but it won't be the last3

3

. Threat hunters at vx-underground estimate the data thieves have exfiltrated sensitive data and secrets from 500,000 machines3

3

. At RSA Conference last week, Mandiant Consulting CTO Charles Carmakal told reporters that Google-owned Mandiant knew of "over 1,000 impacted SaaS environments" actively dealing with the cascading effects of TeamPCP supply chain attacks. "That 1,000-plus downstream victims will probably expand into another 500, another 1,000, maybe another 10,000," Carmakal said, adding that "these actors are collaborating with a number of other actors right now"3

3

.

TeamPCP has publicly stated its intention to partner with ransomware and extortion groups to target affected companies at scale, a strategy that mirrors campaigns like the 2023 Cl0p ransomware gang attack exploiting MOVEit vulnerabilities, which ultimately affected nearly 100 million individuals across government agencies, financial institutions, and healthcare providers5

5

. The incident has prompted LiteLLM to make changes to its compliance processes, including shifting from controversial startup Delve to Vanta for compliance certifications1

1

. With LiteLLM present in an estimated 36% of cloud environments and serving 97 million monthly downloads, the vulnerability exposed a critical weakness in the AI supply chain that companies across the industry must now address4

4

.