Mercor Confirms Breach in LiteLLM Supply Chain Attack

Mercor, a San Francisco-based AI recruiting startup valued at $10 billion, confirmed on Wednesday that it experienced a security incident stemming from a supply chain compromise of the open-source LiteLLM project. The breach, which affected thousands of companies using the widely adopted AI tool, has drawn further scrutiny after the hacking group Lapsus claimed responsibility for stealing hundreds of gigabytes of Mercor's data.

LiteLLM, a Y Combinator-backed project that provides unified interfaces for large language models, disclosed last week that its systems suffered a suspected supply chain attack. Investigators found evidence of unauthorized publishes of malicious code via a compromised PyPI package, a common repository for Python software. The project, downloaded millions of times daily according to security analyses, released a clean version on Monday and announced changes to its compliance processes, including a shift from provider Delve to Vanta for certifications. The initial compromise has been attributed to a hacking group known as TeamPCP, though the exact methods remain under review.

Mercor, founded in 2023, detected anomalous activity in its systems and acted...