Mercor Remote Code Execution Vulnerability
A supply-chain cyberattack on the open-source LiteLLM library led to the planting of malicious code designed for credential harvesting. This incident resulted in a significant data breach at AI startup Mercor, potentially exposing sensitive company data, user information, and confidential AI project details.
STABLE
What Happened
A supply-chain cyberattack on the open-source LiteLLM library led to the planting of malicious code designed for credential harvesting. This incident resulted in a significant data breach at AI startup Mercor, potentially exposing sensitive company data, user information, and confidential AI project details.
Why This Matters
Publisher reporting describes a concrete security event. BugSkan could not yet bind it to a CVE or affected version, so treat the source details as the current record.
Recommended Action
Read the linked source. Identify named vendors, products, or environments and check whether they overlap with yours. Do not wait for a CVE if the report already describes exploitation or a vendor response.
Exposure
Exposure unknown
Apr 04, 2026 05:30
Exposure reason: This incident does not currently match a technology in My Interests.
Exploitation status: UNKNOWN
Primary entities:
Timeline
-
Incident first seen
Apr 02, 2026 05:30BugSkan first recorded this incident.
-
Mercor, a $10 billion AI startup, confirms it was caught up in a major security incident - Fortune
Apr 02, 2026 05:30fortune.com · Data Leak
-
Meta paused its work with AI training startup Mercor after a data breach - Business Insider
Apr 04, 2026 05:30businessinsider.com · Data Leak
-
Latest observed development
Apr 04, 2026 05:30Most recent source or update associated with this incident.
Sources
fortune.com · Apr 02, 2026 05:30
A supply-chain cyberattack on the open-source LiteLLM library led to the planting of malicious code designed for credential harvesting. This incident resulted in a significant data breach at AI startup Mercor, potentially exposing sensitive company data, user information, and confidential AI project details.
Open publisher sourcebusinessinsider.com · Apr 04, 2026 05:30
AI training startup Mercor experienced a data breach resulting from a supply chain attack that leveraged the open-source project LiteLLM, impacting potentially thousands of companies. This incident prompted Meta to pause its collaboration with Mercor while a thorough investigation, supported by third-party forensics experts, is conducted.
Open publisher sourceMy Interests Match
Create an account to see which incidents overlap with your interests.