Mercor Hit by Supply Chain Attack Involving LiteLLM
AI-generated from multiple sources. Verify before acting on this reporting.
SAN FRANCISCO — Artificial intelligence platform Mercor disclosed on Wednesday that it was the target of a supply chain attack involving the open-source proxy server LiteLLM, marking a significant security incident in the rapidly evolving AI infrastructure sector.
The breach was detected on April 2, 2026, at approximately 10:44 a.m. UTC. Security teams identified unauthorized access patterns within the company's internal systems, tracing the vector to a compromised dependency within the LiteLLM framework. LiteLLM is widely used by developers to manage API calls across multiple large language model providers, serving as a critical middleware component for many AI applications.
Mercor, which provides AI-powered workforce solutions, stated that the attack exploited a vulnerability in the third-party software integrated into its deployment pipeline. The company has not specified whether user data was exfiltrated or if the compromise resulted in financial loss. Initial assessments indicate that the intrusion was contained before it could spread to customer-facing services.
The incident highlights the growing risks associated with software supply chains in the artificial intelligence industry. As companies increasingly rely on open-source libraries and third-party integrations to accelerate development, the attack surface expands. Security experts note that supply chain attacks have become a primary vector for cybercriminals seeking to infiltrate high-value targets through trusted dependencies.
Mercor has initiated a full forensic investigation to determine the scope of the breach and the identity of the actors behind it. The company is working with cybersecurity partners to patch the vulnerability and strengthen its defenses against future attempts. No other organizations have publicly confirmed similar incidents linked to this specific attack vector.
Questions remain regarding the origin of the compromised LiteLLM component and whether the vulnerability was introduced through a malicious update or a compromised build environment. The timeline of the attack and the duration of unauthorized access have not been disclosed. Mercor has advised users to review their own deployments of LiteLLM for similar anomalies, though no specific indicators of compromise have been released.
The incident comes amid heightened scrutiny of AI infrastructure security, following several high-profile breaches in the sector over the past year. Regulators and industry leaders are calling for stricter vetting of third-party components and enhanced transparency in software development practices.
As the investigation continues, Mercor has not provided an estimated timeline for full remediation or a detailed impact assessment. The company maintains that its core operations remain stable and that no critical systems were permanently disabled during the incident. Further updates are expected as forensic analysis progresses.