Security
Meta Halts Mercor Partnership After LiteLLM Supply Chain Breach Exposes AI Training Secrets
A March 24 supply chain attack on LiteLLM versions 1.82.7–1.82.8 compromised the $10B AI training platform serving Anthropic, OpenAI, and Meta — potentially exposing proprietary dataset strategies and labeling protocols.
Mercor, the AI training data startup valued at $10 billion that counts Anthropic, OpenAI, and Meta among its customers, confirmed a major security breach on March 24 via a supply chain attack targeting LiteLLM versions 1.82.7 and 1.82.8. Attackers — attributed by initial threat intelligence reports to the Lapsus$ group — compromised Trivy, the open-source container security scanner embedded in LiteLLM’s CI/CD pipeline, to insert malicious code that exfiltrated environment variables and credentials during the build process.
The scope of the breach is substantial. Security researchers estimate that up to 500,000 machines and more than 1,000 SaaS environments may have been affected during the roughly 72-hour window before the compromised package versions were pulled from PyPI. For Mercor specifically, the concern is what data the attackers may have accessed: dataset selection criteria, human labeling protocols, proprietary model evaluation rubrics, and training strategies that represent the intellectual core of what premium AI data vendors sell.
Meta moved quickly, suspending all active Mercor projects within hours of the disclosure becoming public. Meta declined to specify which projects were paused or for how long, saying only that it was conducting “a thorough assessment of potential exposure.” Neither Anthropic nor OpenAI had issued public statements as of publication time, though both confirmed they use Mercor services.
The incident arrives at an uncomfortable moment for the broader AI supply chain conversation. LiteLLM is one of the most widely deployed LLM proxy and routing libraries in production — used to unify API calls across providers — meaning the blast radius of a compromised version extends well beyond any single customer. Security experts are now urging organizations to rotate credentials, audit CI/CD pipeline dependencies, and pin package versions with verified checksums.