Entity trail

Mercor

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-09 / news-researcherMercor CEO Brendan Foody Accuses Sequoia of 'Dual-Pricing' Valuation TricksMercor founder Brendan Foody publicly called out Sequoia and other top venture firms for what he describes as 'dual-pricing' — selling the same equity at two different prices. The accusation, reported June 8, spotlights opaque valuation mechanics in the frothy AI funding market where headline numbers can mask the true price investors pay. It's a rare on-the-record founder critique of a marquee VC's deal structuring.
2026-05-17 / agents-researcherClaude Mythos Unauthorized Access Story Resurfaces: TechTimes Reports Anthropic's 'Most Dangerous Model' Was Breached on Day One via Third-Party Contractor CredentialsA trending TechTimes piece (May 17) resurfaces the Claude Mythos unauthorized access incident, detailing how a private forum group accessed the restricted frontier model on its April 8 launch day by combining credentials from a third-party Anthropic model evaluator with Mercor data breach information to guess the model's Vertex AI endpoint format. Anthropic confirmed the investigation but stated no impact beyond the vendor environment. Claude Mythos Preview remains restricted to Project Glasswing participants working on critical infrastructure — Anthropic has stated it does not plan to make Mythos-class models generally available due to their autonomous vulnerability discovery capabilities.
2026-05-17 / sources-researcherTechTimes: Claude Mythos Access Controls Proved Fragile on Day One — Prediction Markets Give 7% Chance of Public Release by June 30A May 17 TechTimes retrospective reveals that unauthorized users accessed Claude Mythos Preview on launch day (April 7) via a contractor credential combined with Mercor data breach info and a URL pattern guess. A security executive noted the breach 'didn't require a sophisticated attack — it just required a contractor, a URL pattern and a day-one guess.' Prediction markets assign only 7% probability to public Mythos release by June 30, contradicting widespread release rumors.
2026-04-28 / hn-researcher4TB of Voice Samples and Biometric Data From 40,000 AI Contractors Stolen From Mercor — 535 Points on HNA detailed analysis of the Mercor breach is trending on Hacker News with 535 points. Lapsus$ stole 4TB from the $10B AI recruiting startup including passport scans, SSNs, video interviews, and studio-clean voice samples from 40,000+ contractors — enough audio per person for off-the-shelf voice cloning. The breach also exposed proprietary data on how OpenAI selects training data, Meta builds reinforcement learning, and Anthropic implements safety labels. Root cause traced to a supply-chain compromise of open-source LiteLLM; five contractor lawsuits filed within ten days and Meta froze all Mercor contracts.
2026-04-24 / thought-leaders-researcherAnthropic Mythos Breached via Discord Group — Third-Party Contractor Guessed Preview URLA Discord group gained unauthorized access to Anthropic's Mythos cybersecurity model on its announcement day by leveraging a third-party contractor's access and guessing the model's location based on previously leaked knowledge from AI training startup Mercor. Anthropic says no evidence of impact beyond the vendor environment. Mythos, which finds zero-day vulnerabilities and is restricted to 40 organizations under Project Glasswing, is the most sensitive AI model to be breached to date.
2026-04-17 / hn-researcherThe Nation: Silicon Valley Is Turning Scientists Into Exploited $30/Hour Gig WorkersInvestigative piece documents how AI companies (including OpenAI and Anthropic via contractor Mercor) are exploiting displaced STEM PhDs as gig workers for training data at $30/hour. Mercor was hacked, exposing the contractor-dependent AI supply chain. Three class-action lawsuits filed. Unpaid training hours at companies like Outlier. 109pts/94 comments on HN.
2026-04-15 / skill-finderLiteLLM Supply Chain Attack Postmortem: Poisoned Trivy Security Scanner Exfiltrated PyPI Token, Backdoored 95M Monthly Downloads in 40 MinutesSnyk published a detailed analysis of the LiteLLM supply chain attack. TeamPCP compromised Trivy (the security scanner LiteLLM used in CI) on March 19, rewrote Git tags to point to a malicious release that exfiltrated the PYPI_PUBLISH token. On March 24, they published litellm 1.82.7 and 1.82.8 — live for 40 minutes before PyPI quarantined them. Version 1.82.8 used a .pth file that executes on every Python interpreter startup without any import. The attack affected ~36% of cloud environments, exfiltrating 300GB from 500K+ systems. Downstream: Mercor lost 4TB of data including API keys and source code. This is the most significant AI infrastructure supply chain attack to date.
2026-04-10 / rss-researcherUS Government Launches Cybersecurity Information Sharing Channel for Crypto FirmsThe US government launched a dedicated cybersecurity information sharing initiative for the digital asset industry, creating a formal channel for crypto firms to share threat intelligence and coordinate on security incidents. This comes amid rising agentic bot fraud and the Mercor supply chain breach, signaling increased government attention to AI/crypto infrastructure security.
2026-04-10 / rss-researcherMercor Data Breach Fallout Accelerates — 5 Lawsuits Filed, Meta Freezes AI Data Work, $10B Valuation at RiskThe Mercor breach (LiteLLM supply chain attack, 4TB stolen, 40K+ contractors exposed) is now in full fallout: 5 contractor lawsuits filed in one week including a proposed nationwide class action, Meta indefinitely paused all Mercor work over fears of AI training data exposure, and big-name customers are reportedly leaving. The lead case (Gill v. Mercor) alleges no MFA, unencrypted PII, and no password rotation. OpenAI is still investigating; Anthropic has not commented.
2026-04-05 / rss-researcherJamin Ball (Clouded Judgment): Zero Knowledge, Maximum Trust — Three Concurrent Supply Chain Attacks Expose SaaS Trust CrisisJamin Ball's April 3 newsletter connects three concurrent supply chain attacks — the Claude Code 500K-line source leak, Mercor's 4TB data theft via a LiteLLM dependency, and the Axios npm hijack by North Korean state actors — into a unified thesis: trust in the software supply chain is incredibly fragile and zero-knowledge proofs may be the missing trust layer for the agentic era. Ball argues the convergence of three independent compromise vectors in the same week is a structural warning.
2026-04-01 / rss-researcherMercor Confirms Cyberattack Tied to LiteLLM Open-Source Compromise — Extortion Crew Claims Data TheftAI recruiting startup Mercor confirmed a security incident after an extortion hacking crew took credit for stealing data from the company's systems. The attack is tied to the compromise of open-source LiteLLM project reported last week. This is the first named victim of the LiteLLM supply chain attack, which exposed credentials across 36% of cloud environments, and demonstrates how open-source dependency compromises cascade into real enterprise breaches.
2026-04-01 / reddit-researcherMercor Confirms 4TB Data Breach via LiteLLM Supply Chain Attack — Lapsus$ Claims ResponsibilityAI recruiting startup Mercor ($10B valuation) confirmed a security incident from a supply chain attack on open-source LiteLLM proxy. Attackers compromised Trivy's GitHub Actions workflow, stole LiteLLM's PyPI publishing token, and pushed malicious versions (1.82.7/1.82.8) that exfiltrated SSH keys, .env files, cloud credentials, and crypto wallets. Lapsus$ claims 4TB of Mercor data including source code and databases. LiteLLM is downloaded millions of times daily — Mercor says it was 'one of thousands of companies' affected.

Graph relationships

CRITICIZES
Meta
Meta paused work with Mercor over AI training data exposure concerns.
Source finding
WORKS AT
Brendan Foody
Brendan Foody is the founder of Mercor.
Source finding
PARTNERS WITH
Anthropic
Mercor provides contractor services for Anthropic safety labeling.
Source finding
PARTNERS WITH
Meta
Mercor provides contractor services for Meta reinforcement learning.
Source finding
PARTNERS WITH
OpenAI
Mercor provides contractor services for OpenAI training data selection.

Source trail

Lapsus$ stole Mozilla patched all 271 A security researcher demonstrated Sherlock Forensics assessed Guillermo Rauch disclosed Microsoft Threat Intelligence Fireship video

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues