30
Australian police arrest two over TeamPCP hacks targeting Mercor, OpenAI, and others
Australian police arrested two suspects over TeamPCP cyberattacks targeting Mercor, OpenAI, and other tech companies.
Australian police have arrested two people in connection with the TeamPCP hacks. The arrests follow a wave of cyberattacks earlier in the year that targeted tech companies including Mercor and OpenAI, many of which rely on high-profile, widely used open source software. The article provides no technical details or CVE identifiers.
58
60
Inside ‘Project Lily’: The Humans Reading Your ChatGPT Chats
404 Media reveals OpenAI's 'Project Lily' has hundreds of contractors reading real ChatGPT user prompts, exposing sensitive personal data despite privacy filters.
404 Media reports that OpenAI employs hundreds of contractors who read real ChatGPT user prompts, including whole conversations, to rate and critique the chatbot's responses across a user base of over 900 million. Prompts are anonymized and run through OpenAI's Privacy Filter model, but the company acknowledged sensitive personal details can still reach reviewers, and 'user memories summaries' may reveal a user's location and personal context. The review work includes training ChatGPT to be less sycophantic and to stop anthropomorphizing itself, following lawsuits linking the sycophantic 4o model to multiple suicides. Anthropic confirmed it also uses human review to improve its models, and OpenAI's 'improve the model for everyone' data-sharing setting is on by default for free, Plus, and Pro users.
55
57
57
OpenAI has hundreds of contract workers reading your ChatGPT conversations
404 Media investigation reveals OpenAI pays hundreds of contract workers to read anonymized ChatGPT conversations, with disclosure buried in an FAQ.
A 404 Media investigation found OpenAI uses hundreds of contract workers, recruited via Crossing Hurdles and paid over $50/hour through Mercor, to rate real ChatGPT conversations on a seven-point scale to reduce sycophancy. Prompts are anonymized but can still contain sensitive personal data despite a privacy filter OpenAI admits can make mistakes. Users can opt out only via the default-enabled 'Improve the model for everyone' setting, which applies solely to new chats. Anthropic and Google confirmed similar human-review programs for Claude and Gemini.
45
Mecka AI nears $500M valuation in Sequoia-led deal amid rush for robot training data
Mecka AI, which collects human motion data for robot training, is nearing a Sequoia-led round at about a $500 million valuation.
Mecka AI is nearing a new funding round led by Sequoia Capital at a valuation of roughly $500 million, three months after raising $60 million led by Framework Ventures with participation from Menlo Ventures, SV Angel, and Kindred Ventures. Founded in 2024 by Josh Gao, Mogen Cheng, Jason Chong, and Duy Nguyen, the startup pays people to record everyday tasks using body sensors and smartphones to produce egocentric training data for humanoid robots. The company projected a $100 million annual run rate by the end of 2026 and competes with firms like Scale AI, Mercor, Surge, Micro1, and XDOF in the physical-world data market.
28
XDOF, just 3 months out of stealth, is in talks for a Series B at a $1.2B valuation
Robotics data startup XDOF is in talks for a Series B at a $1.2B valuation led by 8VC, three months after emerging from stealth.
XDOF, co-founded in 2024 by UC Berkeley researchers Philipp Wu and Fred Shentu, collects real-world teleoperation data for training general-purpose robots. It raised a $70M Series A in June from Thrive Capital, Andreessen Horowitz, Lux, and Spark Capital, and annualized revenue is approaching $50 million. The company is partnering with UC Berkeley's AI Research lab to release the ABC robot training dataset and already serves about 20 customers, including several frontier AI labs. Terms of the Series B are not final.
50
Bidding war for defunct Spirit Airlines’ employee data will not die
AI firm Micro1 bid $12.5 million for Spirit Airlines' 600 million employee email and chat records, challenging Google's $10 million auction win.
After Spirit Airlines entered bankruptcy, Google won an auction for the airline's data trove with a $10 million bid, beating Mercor's $7.5 million offer, but Micro1 has now counter-offered $12.5 million. The data includes about 600 million email and chat records from 17,000 employees, 17 million OneDrive files, 20.5 million SharePoint items, and over 30 million customer service calls, valuable for AI training. Former employees' unions, including the Association of Flight Attendants-CWA representing 5,500 flight attendants, have taken legal action to block the sale over privacy concerns.
34
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Malicious LiteLLM 1.82.7/1.82.8 PyPI releases tied to the Trivy TeamPCP campaign harvested cloud, SSH, and database credentials, potentially exposing 2,500+ organizations.
CloudSEK reported that two malicious LiteLLM releases on PyPI (versions 1.82.7 and 1.82.8, live about 40 minutes on March 24) harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords, with captured loot files mapping potential exposure to more than 2,500 organizations including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp. The campaign is part of TeamPCP (tracked by Google as UNC6780), linked to the Aqua Security Trivy scanner compromise tracked as CVE-2026-33634 and added to CISA's Known Exploited Vulnerabilities catalog on March 26. The payload used a litellm_init.pth file executed at Python interpreter startup and exfiltrated secrets to models.litellm[.]cloud; the FBI's FLASH-20260702-01 advisory urged rotation of CI/CD, publishing, and cloud credentials.
78
30
30
45
57
57
57
42