Mercor Data Breach: The $10 Billion AI Startup Linked to OpenAI and Anthropic That Just Became Cybersecurity’s Loudest Wake-Up Call

By a cybersecurity analyst covering AI infrastructure threats | Updated April 3, 2026

Four terabytes of data. Source code. Slack conversations. Videos of AI contractors at work. Internal ticketing systems. And an extortion gang bragging about it on a public leak site.

That’s the Mercor data breach in a nutshell, and if you’re in the AI industry, you should be paying very close attention.

Here’s why this story hits differently than your average corporate hack: Mercor isn’t just any startup. It’s the backbone of how companies like OpenAI, Anthropic, and Meta train their AI models. The data that may have been compromised doesn’t just include boring employee records or credit card numbers. It potentially includes the secret sauce of how the world’s most powerful AI systems learn.

Y Combinator president Garry Tan put it bluntly on X: this puts “an incredible amount of state-of-the-art training data from every major lab, worth billions of dollars,” within reach of anyone, including rival nations.

Let’s walk through exactly what happened, how it happened, who’s responsible, and what it means for the future of AI security.

What Is the Mercor Data Breach? (A Quick, Quotable Answer)

The Mercor data breach is a cybersecurity incident confirmed in late March and early April 2026 in which Mercor, a $10 billion AI talent platform that contracts specialized domain experts for OpenAI, Anthropic, and Meta, was compromised via a supply-chain attack on LiteLLM, a widely used open-source Python library. Hacking group Lapsus$ subsequently claimed responsibility for exfiltrating approximately four terabytes of sensitive data, including source code, internal communications, and contractor information. The attack originated with threat actor TeamPCP, which infected LiteLLM versions 1.82.7 and 1.82.8 with credential-stealing malware on March 24, 2026. Mercor confirmed the incident and engaged third-party forensic experts to investigate and remediate the damage.

Section 1: Who Is Mercor – And Why Does a Hack Here Matter So Much?

You’ve probably heard of OpenAI, Anthropic, and Meta. You might not have heard of Mercor. That’s by design. Mercor is the company that operates quietly behind the biggest names in AI, and that invisibility is exactly what made it such a valuable and vulnerable target.

Founded in 2023, Mercor built a marketplace that connects specialized domain experts, scientists, doctors, lawyers, linguists, and engineers, primarily based in India, with AI companies that need high-quality human data to train and validate their models. Think of it as the staffing agency for the AI intelligence supply chain.

The numbers are staggering. Mercor facilitates more than $2 million in daily payouts to its contractor network. In October 2025, it closed a $350 million Series C funding round led by Felicis Ventures, pushing its valuation to $10 billion. For a three-year-old company, that trajectory is extraordinary, and it reflects just how critical Mercor’s role has become in the AI ecosystem.

But here’s where the story gets uncomfortable. When you’re the company that handles sensitive AI training data for multiple competing frontier labs simultaneously, you’re sitting on a concentration of competitive intelligence that would make any nation-state or extortion gang salivate.

The training data Mercor manages isn’t just text scraped from the internet. It’s the curated, expert-vetted, carefully labeled datasets that determine whether an AI model gives a correct medical diagnosis, writes legally sound contracts, or solves complex scientific problems. This is proprietary knowledge with real dollar value, and according to unconfirmed reports circulating after the breach, some of the compromised data may have included information about Mercor’s clients’ secretive AI development projects.

Let that sink in. OpenAI and Anthropic are among the most secretive companies on earth about their model development. If any information about their training methodologies or project roadmaps was swept up in this breach, the competitive and national security implications are severe.

“Gaming stopped being entertainment in 2015; it became social infrastructure.” Apply that same logic here: AI training data stopped being a business asset years ago. It became strategic infrastructure. And strategic infrastructure has always been a target.

Section 2: The Attack Chain – How TeamPCP Poisoned the AI Industry’s Water Supply

This wasn’t a smash-and-grab. The Mercor breach was the downstream consequence of one of the most technically sophisticated and persistent supply-chain attack campaigns security researchers have seen in recent years. To understand what happened, you need to follow the chain from its very beginning.

Step 1: A Security Scanner Gets Compromised

On March 19, 2026, a threat actor group known as TeamPCP, also tracked under aliases including PCPcat, Persy_PCP, and ShellForce, compromised Trivy, the open-source vulnerability scanning tool used by thousands of companies in their CI/CD pipelines. According to Wiz, the cloud security firm that first analyzed the campaign, the attackers injected malicious code into official GitHub Actions workflows and Docker images associated with Trivy. The incident was assigned CVE-2026-33634, with a CVSS4B score of 9.4.

Every automated security scan using compromised Trivy versions became a weapon for harvesting SSH keys, cloud access tokens, cryptocurrency wallets, and other credentials from affected systems. The Trivy team detected and removed the malicious artifacts that same day. But the damage was already spreading.

Step 2: The Incomplete Fix That Opened the Door

Here’s where it gets particularly frustrating. After discovering the Trivy compromise, Aqua Security (Trivy’s maintainer) rotated credentials but not atomically. The rotation wasn’t simultaneous across all access points. According to researchers at Help Net Security, there was a window of several days during which attackers could use valid old tokens to exfiltrate newly rotated secrets. TeamPCP exploited that window.

By March 23, the same attack infrastructure appeared again, this time hitting Checkmarx’s KICS security scanner and VS Code extensions. The attackers even registered the domain checkmarx.zone impersonating the real Checkmarx brand as their command-and-control server.

Step 3: LiteLLM Gets Poisoned

March 24, 2026. 10:39 AM UTC.

LiteLLM’s CI/CD pipeline ran Trivy as part of its standard build process. Because the pipeline pulled Trivy from apt without a pinned version, it grabbed the compromised version. The compromised Trivy action then exfiltrated LiteLLM’s PyPI publishing token from the GitHub Actions runner environment.

With that stolen token, TeamPCP published LiteLLM version 1.82.7 at 10:39 UTC, followed by 1.82.8 at 10:52 UTC. Both versions contained hidden malware.

Version 1.82.7 inserted a credential-harvesting payload into proxy_server.py just 12 malicious lines tucked between two unrelated code blocks, designed to activate whenever LiteLLM’s proxy server ran. Version 1.82.8 went further. It abused Python’s .pth file mechanism, which triggers code execution during interpreter initialization, meaning the malware would fire on every Python process startup, regardless of whether LiteLLM was even explicitly imported. Security researchers at FutureSearch discovered that a bug in version 1.82.8 actually created a fork bomb, crashing machines with exponential subprocess spawning before it could complete its mission.

What was it stealing? Everything. SSH keys and configurations. Cloud provider credentials for AWS, GCP, and Azure. Kubernetes secrets. API keys are stored in .env files. Database passwords. The harvested data was encrypted with a hardcoded 4,096-bit RSA public key and exfiltrated to models.litellm.cloud a domain designed to look like legitimate LiteLLM infrastructure.

LiteLLM is downloaded roughly 3.4 million times per day, according to security firm Snyk. It serves as the backbone of modern AI infrastructure, acting as a universal proxy that helps applications route requests to over 100 different LLM providers, OpenAI, Anthropic, Bedrock, and Vertex AI through a single, standardized interface. CISO Cory Michal of AppOmni called it exactly what it is: “a true software supply-chain compromise that led to malicious package publication, credential theft, and persistence on affected hosts.”

The malicious versions were available for approximately three to five hours before PyPI quarantined them. But in that window, they were downloaded over 40,000 times, according to InfoQ. In cloud environments, those downloads translate to compromised credentials across thousands of organizations.

Step 4: Mercor Detects Anomalous Activity

On Monday, April 28, 2025, Mercor’s security team detected anomalous activity in its systems. Given that its infrastructure relied on LiteLLM, a reasonable choice for a company that manages interactions with multiple AI service providers, the exposure window proved sufficient for attackers to gain a foothold.

By Tuesday, April 29, extortion hacking group Lapsus$ had claimed responsibility on its public leak site. And then the samples started appearing.

Section 3: Lapsus$ vs. TeamPCP Two Threat Actors, One Catastrophe

Wait, two separate hacking groups? Yes, and understanding the distinction matters if you’re trying to make sense of the headlines.

TeamPCP is the group responsible for the technical compromise. They’re a sophisticated threat actor, active since at least December 2025, that has systematically targeted developer and security tooling across multiple ecosystems, GitHub Actions, Docker Hub, npm, OpenVSX, and PyPI. Wiz researchers note that TeamPCP has “exclusively targeted security-adjacent tools” because such tools run with elevated privileges and have access to sensitive credentials by design. Compromise one, and you get everything it was trusted to touch.

Notably, Wiz’s analysis found that a component called hackerbot-claw uses an AI agent for automated attack targeting — documenting one of the first observed cases of an AI agent being used operationally in a supply-chain campaign. The group also deployed CanisterWorm, which uses the Internet Computer Protocol (ICP) as a command-and-control channel — a mechanism that cannot be taken down by domain registrars or hosting providers, making it uniquely resilient to law enforcement action.

Lapsus$ is the extortion group that came in afterward, claiming the data and threatening to release it. This is the notorious gang responsible for high-profile breaches at NVIDIA, Microsoft, and Okta. Their involvement suggests a deliberate collaboration and indeed, TeamPCP publicly stated on cybersecurity trade publication Cybernews its intention to partner with ransomware and extortion groups to target affected companies at scale.

It’s not entirely clear how Lapsus$ obtained the Mercor data specifically. Mercor did not respond to Fortune’s specific questions about the group’s claims. What is clear is that Lapsus$ has published samples of allegedly stolen data, including what appeared to be Slack communications, internal ticketing information, and two videos apparently showing conversations between Mercor’s AI systems and contractors on the platform.

Lapsus$ claims to hold four terabytes of total data from Mercor. To put that in context: one terabyte is roughly equivalent to 1,000 hours of video or 1,000 copies of the Encyclopedia Britannica. They claim to have a database weighing over 200GB, a 3TB drive containing video and verification data, 939GB of source code, and all data from Mercor’s TailScale VPN account.

Whether all of those claims are accurate is unverified. But even partial accuracy would represent a catastrophic compromise.

---

Section 4: What Data Was Exposed And Why It’s Different This Time

Most data breaches involve names, email addresses, and perhaps credit card numbers. You notify customers, offer a year of credit monitoring, and move on.

This is not that kind of breach.

The data allegedly compromised in the Mercor incident falls into several categories, each with distinct implications.

Contractor personal data. Mercor’s network includes thousands of specialized professionals, doctors, lawyers, scientists, and engineers, primarily from India. Their professional credentials, personal identification, and payment information may have been exposed. This creates real risk for individuals who trusted a private platform with sensitive career and financial data.

Proprietary AI training datasets. This is the category that has the cybersecurity and AI policy communities most alarmed. The training data that Mercor manages for clients like OpenAI and Anthropic isn’t public; it’s the product of enormous investment in expert recruitment, quality control, and curation. If competitors, foreign adversaries, or anyone else gains access to it, the competitive moats of the world’s leading AI labs are suddenly much shallower.

Client project information. According to unconfirmed reports, the breach may have included information about customers’ ongoing AI development projects. This is the category that prompted Garry Tan’s national security comment. Knowing what OpenAI or Anthropic is working on, even at a high level, provides extraordinary strategic intelligence.

Infrastructure credentials. The LiteLLM supply-chain attack was specifically designed to harvest API keys, cloud credentials, and configuration secrets. For a company like Mercor that sits between multiple AI service providers and thousands of contractors, those credentials could enable secondary access to other systems and services.

It’s worth noting something that often gets lost in breach coverage: even if Lapsus$ never releases the data publicly, the mere possession of it creates leverage. The extortion model doesn’t require a data dump; it requires only the credible threat of one.

Mercor’s response has been measured but firm. Spokesperson Heidi Hagberg confirmed to TechCrunch that the company “moved promptly to contain and remediate the security incident” and is “conducting a thorough investigation supported by leading third-party forensics experts.” The company said it would “continue to communicate with our customers and contractors directly as appropriate.”

That’s the right language. But the question now is whether actions match words and whether clients like OpenAI and Anthropic will reassess their data-sharing arrangements regardless of how thorough the remediation is.

Section 5: The Bigger Picture: What This Means for AI Security

Here’s the contrarian take you won’t find in most breach coverage: Mercor being hit isn’t surprising. It’s inevitable, and the only surprising thing is that it didn’t happen sooner.

The AI industry has built itself at extraordinary speed on a foundation of open-source dependencies that weren’t designed for the threat environments they now inhabit. LiteLLM, with its 95 million monthly downloads, is the connective tissue of modern AI infrastructure. It was maintained like most open-source projects with limited security resources and enormous trust in the supply chain above it.

Marc Andreessen, co-founder of Andreessen Horowitz, captured the industry mood in a post on X, suggesting that the Mercor attack and a concurrent Anthropic source code leak “mark the end of the AI industry’s ‘we’ll lock it up’ approach to cybersecurity.” That’s almost certainly right.

What does the new approach need to look like? Security researchers and the FBI have begun outlining the answer:

Dependency pinning is no longer optional. LiteLLM’s build pipeline grabbed Trivy without a pinned version. That’s the kind of shortcut that makes sense when you’re moving fast, and security feels like a distant problem. It doesn’t make sense anymore. Every dependency in every production pipeline needs to be pinned to a specific, verified hash. Not a version number, a hash.

Secret rotation needs to be atomic. The Trivy incident was discovered and “remediated,” but the non-simultaneous credential rotation created a window that TeamPCP exploited. Any organization doing credential rotation following a security incident must treat atomicity as a hard requirement, not a nice-to-have.

Open-source tooling needs security investment at scale. The Python Software Foundation, PyPI, and major enterprises all need to recognize that open-source security is not someone else’s problem. The Endor Labs researchers who analyzed the LiteLLM compromise noted that the malicious code was injected during or after the build process it wasn’t visible in the GitHub repository. That means standard code review wouldn’t have caught it. The security posture for critical open-source infrastructure needs to be dramatically elevated.

AI companies need to treat their data supply chains like financial institutions treat their transaction systems. The GDPR created strong incentives for European companies to think carefully about data. What’s needed now is an equivalent framework for AI training data, one that treats its exposure as a significant regulatory and liability event.

FBI Assistant Director of Cyber Division Brett Leatherman wrote on LinkedIn: “Given the volume of stolen credentials across likely thousands of downstream environments, expect an increase in breach disclosures, follow-on intrusions, and extortion attempts in the coming weeks.” That was a warning. Events since suggest it was also a prediction.

TeamPCP has publicly stated it intends to partner with extortion groups to systematically target the thousands of companies affected by the LiteLLM compromise. If the ShinyHunters and Cl0p patterns of the past few years are any guide, and they are, we’re not at the end of this story. We’re somewhere in the middle chapters.

Section 6: The Anthropic Parallel – When One Week Shakes an Industry

It would be incomplete to cover the Mercor breach without mentioning what happened in parallel: a separate, unrelated incident involving Anthropic itself.

Around the same time as the Mercor revelations, Anthropic confirmed to the Wall Street Journal that source code had been leaked not through a hack, but through human error. No AI model weights or core training data were involved, but the leaked material reportedly included information about how the AI could be prompted to perform certain tasks. Anthropic characterized it as not involving the kind of data that powers Claude directly.

Two incidents. One week. Both are touching the AI frontier. Both involve information that, once out, is out forever. The problem with source code exposure, as security experts have noted, is that it gives malicious actors a map for future attacks even if no immediate harm is done.

The coincidence or near-coincidence of these two incidents has rattled the AI industry in a way that individual breaches rarely do. As analyst Daniel Howley noted for Yahoo Finance, “it’s inevitable that an AI company will face some kind of cybersecurity issue during its lifetime, but the fact that the Mercor attack and Anthropic leak occurred in such quick succession heightens the drama for the tech industry.”

The drama is real. But so is the underlying vulnerability.

Expert Perspectives

“The open source supply chain is collapsing in on itself,” said Gal Nagli, head of threat exposure at Google-owned Wiz, in a post on X following the LiteLLM compromise. “Trivy gets compromised → LiteLLM gets compromised → credentials from tens of thousands of environments end up in attacker hands → and those credentials lead to the next compromise. We are stuck in a loop.”

That loop is the core problem. Security tooling is compromised to compromise the tools that trust it. The cascade is structural; it won’t be solved by one company improving its hygiene. It requires industry-wide investment in the trustworthiness of shared infrastructure.

According to Cory Michal, CISO of AppOmni: “What makes it especially notable is that the LiteLLM compromise appears to have been downstream fallout from the earlier Trivy breach, meaning attackers may have used one trusted CI/CD compromise to poison another widely used AI-layer dependency, which is exactly the kind of cascading, transitive risk security teams worry about most.”

Igor Lasic, whose analysis was published by ReversingLabs, put the strategic logic succinctly: “LiteLLM is the backbone of modern AI infrastructure, acting as a universal proxy for LLM APIs. Its popularity makes it an ideal ‘infection hub.'” Targeting the hub, not individual endpoints, is how you maximize blast radius with minimum effort.

Frequently Asked Questions

Was OpenAI or Anthropic directly breached in the Mercor incident? Not directly. Mercor was the breached party. However, Mercor provides AI training data and services to both OpenAI and Anthropic, and unconfirmed reports suggest that datasets used by those clients and information about their AI projects may have been among the compromised data. Neither OpenAI nor Anthropic has publicly confirmed what, if any, of their proprietary information was affected.

What is LiteLLM, and why was it targeted? LiteLLM is an open-source Python library that acts as a universal proxy, allowing developers to route API calls to over 100 different large language model providers through a single interface. It is downloaded roughly 3.4 million times per day and is present in approximately 36% of cloud environments, according to Wiz. Its widespread use and access to sensitive API keys made it an ideal target for credential harvesting at scale.

What should companies do if they used LiteLLM versions 1.82.7 or 1.82.8? Security experts recommend treating any credentials present in those environments as compromised. This means rotating all API keys, cloud provider credentials (AWS, GCP, Azure), SSH keys, Kubernetes secrets, and database passwords. Organizations should also check for the persistence indicators: ~/.config/sysmon/sysmon.py and ~/.config/systemd/user/sysmon.service. If running in Kubernetes, audit the kube-system for pods matching node-setup-*.

Who are TeamPCP and Lapsus$? TeamPCP is a sophisticated threat actor group, active since at least December 2025, known for supply-chain attacks targeting developer and security tooling across multiple ecosystems. Lapsus$ is a separate extortion hacking gang with a history of high-profile breaches at NVIDIA, Microsoft, and Okta. TeamPCP has publicly stated its intention to partner with ransomware and extortion groups like Lapsus$ to monetize access gained through supply-chain compromises.

What is the national security angle? Y Combinator president Garry Tan stated publicly that the breach puts state-of-the-art AI training data from every major lab online and accessible to rivals, including China. AI training data and model development methodologies are increasingly considered strategic assets. The exposure of this kind of information has implications that extend beyond business competition into geopolitical competition.

Will Mercor survive this breach? That remains to be seen. The company’s $350 million in recent funding provides significant resources for remediation and trust rebuilding. However, its business model depends entirely on the confidence that clients and contractors have in its ability to handle sensitive data securely. How OpenAI, Anthropic, and Meta respond whether they maintain, adjust, or terminate their relationships with Mercor will likely determine the company’s trajectory in the coming months.

What Affected Organizations Should Do Right Now

If your organization uses LiteLLM in any production environment, or works with Mercor as a client or contractor, immediate action is required:

Immediate (next 24 hours): Check installed LiteLLM versions with pip show litellm. Inspect UV caches for litellm_init.pth. Rotate all API keys and cloud credentials that may have been accessible from affected environments.

Short term (next 7 days): Audit Kubernetes clusters for unauthorized pods or namespace-level secrets access. Review CI/CD pipeline logs for the period following March 24, 2026. Implement dependency pinning across all build pipelines.

Medium term (next 30 days): Conduct a full third-party security audit of your open-source dependency chain. Implement SBOM (Software Bill of Materials) practices to track what’s in your supply chain. Establish atomic credential rotation procedures for future incidents.

Ongoing: Monitor Cybernews, Snyk, and Wiz advisories for follow-on disclosures. TeamPCPs’ stated intention to partner with additional extortion groups means this wave of breach disclosures is likely still building.

The Bottom Line

The Mercor data breach is not just a story about one startup getting hit. It’s a story about the structural vulnerabilities baked into how the AI industry builds and deploys software. The open-source tools that make AI development possible are maintained by small teams with limited security resources. They’re trusted implicitly by organizations handling some of the most strategically sensitive data on earth.

That trust was always going to be tested. Now it has been.

The question is whether the AI industry and the technology sector broadly will treat this as the watershed moment it actually is, or whether it will manage the news cycle, patch the specific vulnerability, and return to the same dependency practices that created the problem in the first place.

Mercor’s response, OpenAI’s and Anthropic’s response, and the policy and regulatory responses that follow will tell us which world we’re living in.

LiteLLM Supply Chain Attack: The Technical Breakdown | AI Security Best Practices for Startups | Understanding Supply Chain Attacks