Mercor says it was hit by cyberattack tied to compromise of open-source LiteLLM undertaking

[ad_1] Mercor, a well-liked AI recruiting startup, has confirmed a safety incident linked to a provide chain assault involving the open-source undertaking LiteLLM.

The AI startup informed TechCrunch on Tuesday that it was “considered one of hundreds of firms” affected by a current compromise of LiteLLM’s undertaking, which was linked to a hacking group known as TeamPCP. Affirmation of the incident comes as extortion hacking group Lapsus$ claimed it had focused Mercor and gained entry to its information.

It’s not instantly clear how the Lapsus$ gang obtained the stolen information from Mercor as a part of TeamPCP’s cyberattack.

Based in 2023, Mercor works with firms together with OpenAI and Anthropic to coach AI fashions by contracting specialised area consultants akin to scientists, medical doctors, and attorneys from markets together with India. The startup says it facilitates greater than $2 million in each day payouts and was valued at $10 billion following a $350 million Sequence C spherical led by Felicis Ventures in October 2025.

Mercor spokesperson Heidi Hagberg confirmed to TechCrunch that the corporate had “moved promptly” to include and remediate the safety incident.

“We're conducting an intensive investigation supported by main third-party forensics consultants,” mentioned Hagberg. “We'll proceed to speak with our clients and contractors instantly as applicable and commit the assets essential to resolving the matter as quickly as potential.”

Earlier, Lapsus$ claimed accountability for the obvious information breach on its leak website and shared a pattern of information allegedly taken from Mercor, which TechCrunch reviewed. The pattern included materials referencing Slack information and what gave the impression to be ticketing information, in addition to two movies purportedly displaying conversations between Mercor’s AI programs and contractors on its platform.

Techcrunch occasion

San Francisco, CA | October 13-15, 2026

Hagberg declined to reply follow-up questions on whether or not the incident was linked to claims by Lapsus$, or whether or not any buyer or contractor information had been accessed, exfiltrated, or misused.

The compromise of LiteLLM initially surfaced final week after malicious code was found in a bundle related to the Y Combinator-backed startup’s open-source undertaking. Whereas the malicious code was recognized and eliminated inside hours, the incident drew scrutiny as a result of LiteLLM’s widespread use across the web, with the library downloaded hundreds of thousands of occasions per day, per safety agency Snyk. The incident additionally prompted LiteLLM to make modifications to its compliance processes, together with shifting from controversial startup Delve to Vanta for compliance certifications.

It stays unclear what number of firms had been affected by the LiteLLM-related incident or whether or not any information publicity occurred, as investigations proceed.