LiteLLM Remote Code Execution Vulnerability
A supply-chain cyberattack on the open-source LiteLLM library led to the planting of malicious code designed for credential harvesting. This incident resulted in a significant data breach at AI startup Mercor, potentially exposing sensitive company data, user information, and confidential AI project details.
STABLE
What Happened
A supply-chain cyberattack on the open-source LiteLLM library led to the planting of malicious code designed for credential harvesting. This incident resulted in a significant data breach at AI startup Mercor, potentially exposing sensitive company data, user information, and confidential AI project details.
Why This Matters
Publisher reporting describes a security event affecting Meta. BugSkan could not yet bind a CVE or affected version, so treat the source details as the current record.
Recommended Action
Confirm whether Meta is present in your environment and review vendor guidance for this report. Apply available patches or mitigations if your deployment matches the described conditions.
Exposure
Exposure unknown
Apr 04, 2026 05:30
Exposure reason: This incident does not currently match a technology in My Interests.
Exploitation status: UNKNOWN
Primary entities:
Timeline
-
Incident first seen
Apr 02, 2026 05:30BugSkan first recorded this incident.
-
Mercor, a $10 billion AI startup, confirms it was caught up in a major security incident - Fortune
Apr 02, 2026 05:30fortune.com · Data Leak
-
Meta paused its work with AI training startup Mercor after a data breach - Business Insider
Apr 04, 2026 05:30businessinsider.com · Data Leak
-
Latest observed development
Apr 04, 2026 05:30Most recent source or update associated with this incident.
Sources
fortune.com · Apr 02, 2026 05:30
A supply-chain cyberattack on the open-source LiteLLM library led to the planting of malicious code designed for credential harvesting. This incident resulted in a significant data breach at AI startup Mercor, potentially exposing sensitive company data, user information, and confidential AI project details.
Open publisher sourcebusinessinsider.com · Apr 04, 2026 05:30
AI training startup Mercor experienced a data breach resulting from a supply chain attack that leveraged the open-source project LiteLLM, impacting potentially thousands of companies. This incident prompted Meta to pause its collaboration with Mercor while a thorough investigation, supported by third-party forensics experts, is conducted.
Open publisher sourceRelated Incidents
Other BugSkan incidents that share identifiers, products, or vendors with this report.
My Interests Match
Create an account to see which incidents overlap with your interests.