Mercor is the $10 billion company quietly supplying the human workforce that trains ChatGPT, Meta's models, and Anthropic's Claude. Last month, hackers walked out with 4 terabytes of their data — 40,000 Social Security numbers, passport scans, W9 forms — and Mercor said nothing.

The entry point was three steps upstream: malicious code pushed into LightLLM, an open-source Python tool downloaded 95 million times a month. Forty minutes later, attackers had 900GB of Mercor's source code, 200GB of contractor personal data, and a direct window into the training pipelines of the biggest AI labs in the world.

A company with a $350 million Series C had zero multi-factor authentication on the systems holding that data. The SOC 2 certification meant to catch exactly this? A whistleblower confirmed the auditing firm was rubber-stamping instead of checking. If you assumed someone responsible was watching AI infrastructure — this is what that actually looks like.

ABOUT SLOP WORLD

AI news with receipts. Juan Faisal and Kate Cook fact-check the claims Big Tech is making about AI, follow the money, and break down what it actually means for your job, your data, and your daily life. From leaked data and corporate cover-ups to AI schools, stolen identities, and layoff headlines that don't add up, we cover the AI stories that everyone's hyping but nobody's verifying. New episodes every Thursday.

DISCLAIMER

All content is commentary and opinion based on publicly available documents, interviews, and verifiable sources. References to "scams," "grifts," or related terms reflect our editorial opinion, not legal conclusions. Anyone featured who believes a statement is inaccurate may contact us.

CHAPTERS

00:00 A $10B AI Contractor Got Hacked. 40,000 SSNs Gone.

01:45 Meet Mercor: The Hidden Company Training ChatGPT

04:07 How the Hack Worked in 40 Minutes

07:27 What a Stolen SSN Does to You

09:11 The Security Audit Was a Rubber Stamp

13:52 The Workers Knew. Nobody Listened.

16:42 Who F***ed Up: Mercor, the AI Labs, or Everyone?