Last seen April 3, 2026

News report

Mercor Breach Linked to LiteLLM Attack Raises AI Supply Chain Security Concerns

Attackers executed a supply-chain attack on the open-source library LiteLLM by exploiting stolen credentials to inject malicious code into its PyPI distribution pipeline. This malware actively harvested sensitive information, including API keys and cloud credentials, from affected systems, potentially leading to the compromise of up to 4TB of data from companies like Mercor.

Category
News
Lifecycle Status

STABLE

What Happened

Attackers executed a supply-chain attack on the open-source library LiteLLM by exploiting stolen credentials to inject malicious code into its PyPI distribution pipeline. This malware actively harvested sensitive information, including API keys and cloud credentials, from affected systems, potentially leading to the compromise of up to 4TB of data from companies like Mercor.

Why This Matters

This is source reporting of a security event, not a confirmed product vulnerability or patchable CVE. Use it as situational awareness if named organizations, cloud tenants, or identity systems overlap with yours.

Recommended Action

Read the source report. Confirm whether any named organizations, identity tenants, or cloud environments you operate are implicated. Do not treat this as a vendor advisory unless a CVE or official bulletin is attached.

Exposure

My AI Stack Exposure

Exposure unknown

Recommended Response
Last Seen

Apr 03, 2026 05:30

Exposure reason: This incident does not currently match a technology in My AI Stack.

Exploitation status: UNKNOWN

Primary entities:

Remote Code ExecutionSupply ChainBerriAI/litellmlitellm

Timeline

  • Incident first seen
    Apr 03, 2026 05:30

    BugSkan first recorded this incident.

  • Mercor Breach Linked to LiteLLM Attack Raises AI Supply Chain Security Concerns - Techgenyz
    Apr 03, 2026 05:30

    techgenyz.com · News

Sources

Mercor Breach Linked to LiteLLM Attack Raises AI Supply Chain Security Concerns - Techgenyz

techgenyz.com · Apr 03, 2026 05:30

Attackers executed a supply-chain attack on the open-source library LiteLLM by exploiting stolen credentials to inject malicious code into its PyPI distribution pipeline. This malware actively harvested sensitive information, including API keys and cloud credentials, from affected systems, potentially leading to the compromise of up to 4TB of data from companies like Mercor.

Open publisher source

My AI Stack Match

Want personalized relevance?

Create an account to see which incidents overlap with your AI stack.

← Back to incident intelligence