The AI models you use every day were partly trained by real people. Doctors, lawyers, engineers, specialists who get paid to evaluate outputs and teach the models where they're wrong. Those people apply through vendors. They submit resumes, record video interviews, upload passport scans and government IDs. They trust that the company handling their data has its security figured out.
Mercor, a $10 billion AI training data vendor used by OpenAI, Anthropic, Meta, and Google DeepMind, did not have its security figured out. On April 2, the company confirmed a data breach that may have exposed 4 terabytes of data: 211GB of candidate records including Social Security numbers and contact information, 939GB of source code including matching algorithms and API keys, and roughly 3TB of video interviews and identity documents with passport scans and facial biometric data.
The breach didn't start at Mercor. It started three layers away, at a security tool that was supposed to prevent exactly this kind of thing.
How One GitHub Token Broke Everything
In February 2026, a threat group called TeamPCP found a misconfiguration in Trivy, a widely used open-source vulnerability scanner made by Aqua Security. They stole a privileged access token. By mid-March, they had used that token to compromise Trivy's distribution channels, replacing trusted versions with malicious ones and publishing an infected Trivy binary.
From there, TeamPCP harvested credentials from Trivy's downstream users, including the maintainers of LiteLLM, an open-source AI gateway that provides a single interface to over 140 AI providers and 2,500 models. According to Wiz, LiteLLM was installed in 36% of the cloud environments they analyzed. It gets 3.4 million downloads per day from PyPI, Python's package repository.
On March 24, TeamPCP published two backdoored versions of LiteLLM to PyPI: versions 1.82.7 and 1.82.8. The malicious payload was a file that executed automatically on every Python process startup, not just when someone imported LiteLLM. It immediately swept every credential it could find: SSH keys, AWS tokens, Kubernetes secrets, database passwords, cryptocurrency wallets, and environment files. Then it deployed persistent backdoors and started exfiltrating data to attacker-controlled servers.
The packages were live for up to several hours before PyPI quarantined them. In that window, over 40,000 downloads occurred. Mandiant estimates more than 1,000 SaaS environments were compromised. Threat hunters project data was exfiltrated from up to 500,000 machines.
Mercor was one of them.
What Got Taken
The extortion group Lapsus$, which has a working relationship with TeamPCP according to Palo Alto Networks, claimed credit for the Mercor data and published samples on its leak site. The division of labor: TeamPCP broke in, Lapsus$ took the data and made the public claims.
After harvesting Mercor's credentials through the LiteLLM compromise, the attackers gained full access to Mercor's Tailscale VPN environment, giving them a complete map of internal systems and the ability to impersonate trusted machines.
The claimed haul, which Mercor has not fully confirmed:
The candidate database contained resumes, Social Security numbers, government IDs, and contact information for over 40,000 people. The source code included Mercor's proprietary matching algorithms, internal dashboards, and benchmarking tools. The storage buckets held thousands of hours of video interviews showing real people working through real problems, plus passport and driver's license scans used for identity verification.
A class action lawsuit was filed on April 1 by Lisa Gill in the Northern District of California, alleging Mercor failed to implement multi-factor authentication or encrypt sensitive data at rest. At least three additional lawsuits have followed.
Why This Matters to You
Mercor isn't a household name, but its work touches the AI products millions of people use daily. The company operates a network of over 300,000 credentialed professionals who provide the human feedback that trains AI models. Doctors reason through diagnoses. Lawyers analyze legal scenarios. Engineers solve problems. Their evaluations teach the model what a good answer looks like. This process, called reinforcement learning from human feedback, is one of the things that separates a useful AI from a random text generator.
Meta paused its relationship with Mercor after the breach. OpenAI said it is investigating. Anthropic has said nothing publicly.
What got exposed isn't model weights or the AI itself. It's the methodology: how training data is structured, which experts work on which projects, what evaluation benchmarks matter, and how the whole pipeline is organized. The Meridiem called it "methodology exposure," competitive intelligence that took years and billions of dollars to develop, potentially accessible to anyone who obtains the leaked data.
The Dependency Nobody Audits
Here is the chain: A security scanner (Trivy) was compromised. That compromised an AI gateway (LiteLLM) installed in more than a third of cloud environments globally. That compromised a training data vendor (Mercor) handling sensitive information for the four largest AI labs on the planet. One stolen GitHub token, three layers of software supply chain, and 40,000 people's personal data on the other end.
Every link in that chain was open source, community-maintained, and trusted by default. Nobody audited the dependency. Nobody questioned why a training data vendor's production environment automatically pulled packages from a public repository without pinning versions. The CVE assigned to the LiteLLM compromise carries a severity score of 9.4 out of 10.
The AI industry talks constantly about alignment and safety. It talks about making sure the models behave. It talks much less about the humans who train those models and the infrastructure that connects them. Those people just found out the hard way that the supply chain they're part of is held together by trust, and trust is not a security protocol.