After the Mercor Incident, Security Is a Procurement Gate
On March 31, 2026, Mercor confirmed a security incident that also affected thousands of organizations worldwide; four days later, Meta suspended all cooperation indefinitely (Wired). Its October 2025 Series C valued it at $10 billion, with OpenAI and Anthropic as clients. Labs did not leave; data security moved from a compliance appendix to the entry gate, and every parallel vendor must clear it.
01The incident path
LiteLLM, an open-source AI interface library, is downloaded millions of times daily (Snyk). Attack group TeamPCP put malicious code into two versions; the credential-stealing one was online about 40 minutes (TechCrunch). The entry was a dependency, not Mercor's code; attack surface follows headcount, not company size.
Consequences: Meta paused indefinitely; OpenAI checked whether its proprietary training data was exposed — projects not stopped; five contractors sued over personal information exposure (Business Insider). Mercor's June 25 summary: scope limited to expert sensitive information and client data; all frontier model clients increased cooperation over the past months — one largest client left; engagement grew.
02What vendors hold
Vendors generate custom proprietary datasets for labs — highly confidential, as they expose key training methods to competitors including other labs in the US and China (Wired). Three layers: the tasks (questions, environments); the scoring criteria (the direction the model is pushed); the project's requirement description (which capability the client wants to fill).
The third layer is most sensitive: not data, but a list of where this lab believes it is weak. Meta's project codenamed Chordus teaches models to verify answers against multiple web sources. So: requirement descriptions at the highest classification, need-to-know only; scoring criteria never bundled with task data in delivery.
03Parallel sourcing was already normal
All AI developers use multiple data vendors; after the Scale event they moved budgets fast (The Verge, December 2025). That event: June 2025, Meta bought 49% of Scale AI; rival labs, fearing it was no longer neutral, left — Handshake's CEO told The Verge demand tripled overnight. But Scale's interim CEO said that September it still worked with Google, Microsoft, OpenAI, and xAI. Meta kept working with Mercor after buying Scale (TechCrunch) — parallel sourcing made pausing cheap.
The response is the same: distribute, shrink exposure, do not exit. Security and legal decide the pause; algorithm teams comply and their cadence does not stop — replacements must be on the list and have run small batches beforehand. The switching checklist adds one item: after an incident, would you still hand this vendor your scoring criteria?
Contracts add dependency audits, credential management, data isolation, contractor data protection, incident notification deadlines, client audit rights, and settlement terms for suspended work — settlement the most disputed: vendor says delivered, client says suspension-period data will not be accepted. Falsification: if head-lab contracts still lack notification deadlines and audit clauses by Q1 2027, wrong.
04Revenue basis
CEO Brendan Foody said on X that annualized revenue passed $2 billion in June, double four months earlier — monthly revenue times 12, gross, no expert-pay deduction. The Information's funding documents give another set: $614 million total revenue in H1 2026, 70% higher than all of 2025, about 91% from foundation model companies, about two-thirds of revenue paid to contractors, Q2 gross margin 33% — so roughly $670 million net.
Micro1 is more explicit: gross annualized grew to $500 million in eight months, 60-70% goes to experts, net annualized $150-200 million (TechCrunch) — same word, three times apart; align first. March's incident did not stop June's doubling; the 91% concentration stands. Appen draws 80% of revenue from five clients; market cap fell from over $4.3 billion in 2020 to below $130 million now (The Verge). Mercor forecasts foundation model clients below one-third by 2030; test: disclosed share still above 80% in 2027 means the forecast failed.
Resale is the collision: Micro1 sells the same ready-made data to multiple clients at 80-90% gross margins (TechCrunch), while large domestic buyers apply exclusivity — exclusive dataset windows or staged buyouts of supplier core staff (智能涌现). Whether the window starts at delivery or acceptance differs by weeks of resale. Advice to vendors: concede exclusivity for a longer engagement and prepayment.
05What moves in-house
Mercor's own funding materials concede clients have good reason to keep data production in-house for core capability and data security; external buying wins on speed, flexibility, expert supply. ByteDance began in early June 2026 folding Global Data, the group data platform DMC, and Flow's AI data platform AIDP into a first-level department, "AI Data and Security," parallel to Seed and Flow, covering standard-setting, sourcing, synthetic cleaning, and quality evaluation (智能涌现). Whoever buys the data answers for its security.
My three layers: generic parallelizable expert tasks stay external, across three to five vendors; scoring criteria and environments defined internally, execution external — no vendor sees the full recipe; the core recipe and internal eval sets stay in-house. The middle layer is cheap and caps the loss when one vendor fails. If head labs still hand complete scoring criteria to a single vendor next year, wrong.
Advice to peers: turn security into material you can show clients — dependency audit records, credential rotation, expert-client data isolation. A 40-minute flaw in one open-source library got a vendor with $2 billion gross annualized indefinitely paused by one major client; another investigated and kept working. Industry revenue did not turn down; security is now an entry condition, and the business continues.