Mercor Faces Major Security Breach Affecting AI Companies

A significant security breach has impacted Mercor, a startup providing training data to AI companies such as OpenAI, Anthropic, and Meta. According to Fortune and ChainCatcher, the incident resulted from a supply chain attack on the open-source library LiteLLM, widely used by developers to connect AI services, with millions of daily downloads. The attack was initiated by the hacker group TeamPCP, which inserted malicious code into LiteLLM to steal credentials. Subsequently, another hacker group, Lapsus$, claimed to have obtained up to 4TB of Mercor's data, including source code, database records, internal Slack communications, and platform conversation videos. Unverified reports suggest that some customer datasets and confidential AI project information may have been compromised. Mercor has responded swiftly to contain the situation and has launched a third-party forensic investigation to address the breach.