AI recruiting startup Mercor confirmed a security incident linked to a supply chain attack on the open-source project LiteLLM. The breach involves a malicious code injection discovered in a package associated with LiteLLM, attributed to a hacking group known as TeamPCP. Mercor stated it is one of thousands of companies potentially affected by this compromise. Earlier in the week, the extortion group Lapsus$ claimed responsibility for targeting Mercor and gaining access to its data. While Lapsus$ posted a sample of alleged stolen materials on its leak site, including Slack data, ticketing information, and videos purporting to show AI conversations on Mercor's platform, the exact connection between the two events remains uncertain. It is not yet clear if the data exposed by Lapsus$ was obtained directly through the TeamPCP attack on LiteLLM or via a separate vector. Founded in 2023, Mercor connects companies like OpenAI and Anthropic with specialized domain experts, including scientists, doctors, and lawyers, primarily from India. The startup facilitates over $2 million in daily payouts and achieved a valuation of $10 billion following a $350 million Series C funding round led by Felicis Ventures in October 2025. Mercor spokesperson Heidi Hagberg confirmed that the company moved quickly to contain and remediate the security incident. She stated that Mercor is conducting a thorough investigation with the assistance of leading third-party forensic experts. The company plans to communicate directly with affected customers and contractors as necessary and is dedicating resources to resolve the matter as soon as possible. When pressed on the specifics, Hagberg declined to confirm whether Lapsus$ claims were accurate or to detail if any customer or contractor data was accessed, exfiltrated, or misused. The initial compromise of LiteLLM surfaced after malicious code was identified in its software package. Security firm Snyk reported that the library is downloaded millions of times daily, making it a critical piece of infrastructure for many organizations. Although the malicious code was identified and removed within hours, the incident raised significant concerns regarding software supply chain security. In response, LiteLLM has updated its compliance processes, replacing the controversial startup Delve with Vanta for compliance certifications. Investigations into the full scope of the LiteLLM incident are ongoing. It remains unknown exactly how many organizations were impacted or whether any data exposure has occurred beyond the initial discovery. The event highlights the growing risks associated with third-party dependencies in the AI development ecosystem.