Supply chain attack on LiteLLM exposes AI training data and source code
A supply chain attack on the open-source LiteLLM project exposed customer data at Mercor, an AI training startup, with the Lapsus$ hacking group claiming responsibility. The incident exposed training data from major AI labs to potential rivals and prompted Meta to pause work with Mercor while investigations continued.
What happened
Mercor, an AI training startup, was hit by a supply chain attack involving the open-source LiteLLM project, according to the company's statement to Business Insider. The hacking group Lapsus$ claimed to have gained access to Mercor's customer data through this attack.
Anthropic also experienced a data breach in the same period, but this resulted from human error rather than a cyberattack. The leak included source code and information about how the company can instruct its AI to perform certain tasks.
Reported impact
Mercor's customers, including OpenAI and Anthropic, were exposed to potential data compromise. Y Combinator president Garry Tan stated that the hack put state-of-the-art training data from every major lab worth billions of dollars online, creating what he described as a national security problem.
Meta paused all its work with Mercor following the data breach. Once Anthropic's code was released online, it created potential for malicious actors to use it to attack the AI in the future, according to reports.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.