Two sources confirm to WIRED that Meta has paused its entire work with Mercor, a data-contracting company. The pause is indefinite as Meta investigates a serious security breach which affected the startup. According to the sources, this pause will last indefinitely. The sources said that the pause is indefinite. major AI labs According to sources familiar with this matter, they will also reevaluate their relationship with Mercor once the full scope of the incident is known.
Mercor has been in business for over 50 years. OpenAI, AnthropicIt is used by, and many other AI labs to produce training data. It hires a large network of contractors to create proprietary, bespoke datasets. They are usually kept very secret, as these data sets are essential to the creation of AI models for products such as ChatGPT. Claude Code. AI labs are sensitive about this data because it can reveal to competitors—including other AI labs in the US and China—key details about the ways they train AI models. It is not yet clear if the data revealed in Mercor’s hack would be useful to a rival.
OpenAI is not stopping its projects with Mercor but it has confirmed that it’s investigating the incident. It wants to know how proprietary training data of the startup may have leaked. A spokesperson for OpenAI says the incident does not affect OpenAI’s user data. WIRED’s inquiry for comment from Anthropic was not answered immediately.
Mercor acknowledged the assault in an e-mail sent to employees on March 31. “There was a recent security incident that affected our systems along with thousands of other organizations worldwide,” The company has written.
WIRED was told that Mercor employees echoed the same points on Thursday when they sent a memo to contractors. Contractors who were staffed on Meta projects cannot log hours until—and if—the project resumes, meaning they could functionally be out of work, a source familiar claims. WIRED has seen internal discussions that indicate the company will be looking for additional work to accommodate those affected.
Mercor did not explain why Meta projects had been paused. In a Slack channel related to the Chordus initiative—a Meta-specific project to teach AI models to use multiple internet sources to verify their responses to user queries—a project lead told staff that Mercor was “currently reassessing the project scope.”
Recent reports indicate that an attacker called TeamPCP has compromised two versions the AI API LiteLLM. This breach affected companies that use LiteLLM or have installed the tainted update. The breach could affect thousands, and include other AI giants, but the breach in Mercor highlights the sensitive nature of the data.
Mercor and its competitors—such as Surge, Handshake, Turing, Labelbox, and Scale AI—have developed a reputation for being incredibly secretive about the services they offer to major AI labs. These firms rarely have their CEOs speak publicly about what they do, or even use the codenames they internalize to refer to specific projects.
A group known as the “Hackers” has added to the confusion surrounding the hack. Lapsus$ This week, Mercor was claimed to have been breached. On a BreachForums clone and a Telegram channel, the actor claimed to have breached Mercor. He offered for sale a wide range of alleged Mercor files, such as a 200 GB+ database, 1 TB+ of source code, 3 TBs+ of videos and other data. Researchers say many cybercriminal organizations now regularly use the Lapsus$ brand and that Mercor’s confirmation of LiteLLM’s connection to TeamPCP means the attacker was likely TeamPCP.
TeamPCP has hacked the LiteLLM update as part of a larger hacking campaign that is gaining momentum in recent months, propelling TeamPCP into prominence. TeamPCP is not only launching ransomware and data extortion threats, but also working with other groups such as Vect. They have even strayed onto political ground, distributing a data wiping virus known as “CanisterWorm” Through vulnerable cloud instances that have Farsi set as the default language, or with clocks configured to Iran time.
“TeamPCP is definitely financially motivated,” Allan Liska, a ransomware expert at the Recorded Future security firm. “There might be some geopolitical stuff as well, but it’s hard to determine what’s real and what’s bluster, especially with a group this new.”
Liska suggests that you can find the alleged Mercor information on the dark web. “There is absolutely nothing that connects this to the original Lapsus$.”
