Executive Summary
Two AI industry incidents: a supply chain attack on Mercor linked to LiteLLM, with Lapsus$ claiming client data, and a human-error leak of Anthropic source code.
What Happened
This report covers two recent AI-related security incidents: a supply-chain attack on Mercor linked to the LiteLLM open-source project, and a separate leak of Anthropic source code attributed to human error.[4] The Mercor case involved alleged access to client data claimed by the Lapsus$ group, underscoring AI supply chain and third-party library risks for startups and fintech platforms using LLM infrastructure.[4]
Affected Products
- Mercor
- LiteLLM
- Anthropic
Vulnerability / Attack Technique
AI supply chain compromise and source leak
Technical Mechanism
Compromised library and accidental exposure.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
AI startups inherit risk from shared libraries.
Recommended Controls
- Rotate secrets exposed to LiteLLM
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
Yahoo Finance: https://finance.yahoo.com/sectors/technology/article/twin-cybersecurity-incidents-leave-ai-industry-shaken-141850823.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.