Mercor Confirms 4TB Breach via LiteLLM Supply Chain Attack. If You Use LiteLLM, Check Your Versions Now.

A single compromised GitHub Actions workflow. That's all it took.

TechCrunch reports AI recruiting startup Mercor ($10B valuation) confirmed a security incident traced back to a supply chain attack on the open-source LiteLLM proxy. The attack chain is a case study in cascading dependencies. Attackers first compromised Trivy's GitHub Actions workflow. From there, they stole LiteLLM's PyPI publishing token. Then they pushed malicious versions 1.82.7 and 1.82.8 to PyPI that exfiltrated SSH keys, .env files, cloud credentials, and crypto wallets. Lapsus$ claims 4TB of Mercor data including source code and databases. Mercor says they were "one of thousands of companies" affected.

Thousands. LiteLLM is downloaded millions of times daily. Ben Thompson at Stratechery published an analysis the same day arguing AI will make security worse short-term before it gets better. Hard to argue with that when a single compromised CI workflow can cascade into 36% of cloud environments being exposed.

The ugly truth is this attack wasn't sophisticated. It was patient. Trivy to GitHub Actions to PyPI to LiteLLM to Mercor. Each hop was a well-known attack surface. The defense should have been well-known too: pin dependency versions, verify package signatures, audit your CI pipeline's secret exposure. Most teams don't do any of that for their Python dependencies.

If you're running LiteLLM in production, check your installed version right now. If it's 1.82.7 or 1.82.8, you need to rotate every credential that environment had access to. Not tomorrow. Now. Then audit your PyPI dependency pinning strategy, because this won't be the last supply chain attack that targets the AI tool layer. The attacker surface keeps growing as every team adds more AI dependencies, and most of those dependencies don't have the security scrutiny that older, established packages get.