# TeamPCP Hackers Auction Mistral AI's Source Code for $25,000, Threaten Public Leak


The TeamPCP hacker group has claimed responsibility for stealing approximately 450 code repositories from Mistral AI, a French artificial intelligence company founded by former researchers from DeepMind and Meta. The threat actors are now actively marketing the stolen source code on dark web forums, demanding $25,000 for the data while threatening to release it publicly if no buyer emerges within a week. The incident underscores the ongoing vulnerability of software supply chains and the lucrative market for proprietary AI training data.


## The Threat


TeamPCP is offering what it claims to be nearly 5 gigabytes of "internal repositories and source code" used by Mistral AI for training, fine-tuning, benchmarking, model delivery, and inference experiments. In a post on a hacker forum, the group stated: "We are looking for $25k BIN or they can pay this and we will shred these permanently, only selling to the best offer and limited to one person."


The threat actor has adopted a relatively transparent negotiation posture, explicitly stating that the asking price is negotiable and that interested parties may submit counterbids. This approach differs from typical extortion campaigns where hackers maintain anonymity and inflexible demands. TeamPCP's willingness to engage suggests they view the stolen Mistral AI data as legitimately valuable intellectual property rather than purely a coercive leverage tool.


The group's deadline creates artificial urgency: if no buyer purchases the data within seven days, TeamPCP threatens to release all 450 repositories freely to hacker forums, eliminating any exclusivity value and maximizing reputational damage to Mistral AI.


## Background and Context: The TanStack Supply Chain Attack


The Mistral AI breach did not occur through a direct attack on the company's infrastructure. Instead, it resulted from the Mini Shai-Hulud supply chain attack, a sophisticated campaign that compromised official packages from TanStack—a popular open-source library ecosystem—and subsequently spread to hundreds of downstream projects.


The attack began with compromised CI/CD credentials, allowing threat actors to inject malicious code into legitimate build pipelines. TanStack packages were contaminated and distributed through npm (Node Package Manager) and PyPI (Python Package Index), two of the world's largest software registries. From there, the infection cascaded to numerous organizations that depend on these libraries, including:


  • Mistral AI (the primary target of this article)
  • UiPath (robotic process automation platform)
  • Guardrails AI (AI safety framework)
  • OpenSearch (search and analytics engine)
  • OpenAI (which separately confirmed exposure of employee workstations)

    • This multi-stage compromise highlights a critical vulnerability in modern software development: organizations can be breached not through their own security failures, but through compromises in their dependencies and supply chain partners.


    ## Technical Details: How the Compromise Occurred


    According to Mistral AI's statement to security publication BleepingComputer, a developer's device was initially compromised through the TanStack supply chain attack. The contaminated packages introduced malware or backdoors that gave threat actors a foothold on systems using those libraries.


    From the compromised developer machine, attackers then pivoted laterally to access Mistral AI's codebase management systems. This pivot likely succeeded because:


    1. CI/CD credentials were stored locally on the developer's machine or accessible through environment variables

    2. Git credentials or repository access tokens were cached or stored in a standard location

    3. Multi-factor authentication was either not enabled or was successfully bypassed for development infrastructure access


    Once inside the codebase repository, the attackers exfiltrated approximately 450 repositories and 5 gigabytes of source code over an undetermined period. The large volume of data suggests either extended dwell time on Mistral AI's systems or rapid, bulk exfiltration methods.


    ## Scope and Impact Assessment


    Mistral AI provided important clarification about what was not compromised, which is nearly as significant as what was stolen:


    Confirmed Compromised:

  • SDK (Software Development Kit) packages and related source code
  • Internal development repositories

    • Confirmed NOT Compromised:

  • Hosted services and production infrastructure
  • Managed user data (customer data, APIs, etc.)
  • Research and testing environments
  • Core model code repositories

    • This distinction matters substantially. While the loss of 450 repositories and 5 gigabytes of source code is serious, Mistral AI appears to have contained the breach before threat actors accessed the company's most valuable assets—the actual trained AI models, user databases, and production systems.


    However, the stolen SDK code still carries significant value:


  • Competitive intelligence on Mistral AI's software architecture and engineering practices
  • Model integration code that reveals how Mistral embeds AI models in products
  • Testing frameworks and benchmarks that competitors could use to evaluate Mistral's models
  • Security implementation details that attackers could analyze for weaknesses in Mistral's products

    • ## HackWire Analysis


    The TeamPCP auction of Mistral AI source code represents a maturation in the hacker-as-business ecosystem. Rather than deploying stolen code for extortion or ransom, threat actors are now treating intellectual property as a commodity with genuine market value—a shift that should concern not just AI companies, but any organization with proprietary source code.


    The price point is instructive. At $25,000, TeamPCP is pricing Mistral's stolen repositories below what a sophisticated competitor or nation-state security analyst might pay for such intelligence, yet above what most independent hackers could afford. This suggests the group is targeting mid-market buyers: likely competitors in the AI space, venture-backed startups seeking design inspiration, or security consultants evaluating AI software for vulnerabilities.


    The broader pattern is troubling. Supply chain attacks have evolved from binary outcomes (systems infected or not) to precision targeting. The TanStack attack didn't randomly compromise thousands of developers—it spread deliberately to specific high-value targets like Mistral AI, OpenAI, and UiPath. Threat actors have moved beyond mass exploitation toward surgical strikes against organizations with the most valuable intellectual property.


    What other reporting has largely missed: Mistral AI's public claim that "impacted data was not part of the core code repositories" may provide insufficient comfort. SDK code, training frameworks, and benchmarking tools can be reverse-engineered or analyzed to infer model architecture, optimization techniques, and inference performance characteristics. A sophisticated competitor doesn't need the model weights themselves—they need the roadmap of how Mistral engineers solve problems.


    Additionally, the willingness of threat actors to *negotiate* rather than simply extort suggests the stolen data has independent value outside of coercion. That's the real risk signal: when your source code becomes a fungible asset on dark web markets, the attack surface expands beyond any single buyer.


    — HackWire Editorial


    ## Recommendations for AI Companies and Developers


    For Mistral AI and Similar Organizations:

  • Accelerate detection of supply chain compromises: Implement system behavioral monitoring that flags unusual code repository access patterns or bulk data transfers
  • Segment development infrastructure: Isolate high-value repositories (model code, training frameworks) from general-purpose development systems
  • Rotate all potentially exposed credentials immediately: Any credentials that touched compromised developer devices should be revoked
  • Audit downstream dependencies monthly: Know which packages your projects depend on and monitor them for security advisories

    • For All Organizations Using Compromised Dependencies:

  • Conduct forensic analysis on compromised machines: Determine what access an attacker gained and what else might be accessible from that foothold
  • Implement zero-trust access to repositories: Require multi-factor authentication and IP whitelisting for code repository access
  • Use hardware security keys for critical credentials: Resist phishing and credential theft for your most sensitive systems

    • For the Broader AI Ecosystem:

  • Treat source code and training data with encryption at rest: Make exfiltration detectable even if access is gained
  • Join industry information sharing groups: Participate in ISAC (Information Sharing and Analysis Centers) to learn about emerging threats early
  • Establish clear incident response playbooks: Know who gets notified and in what order when a supply chain compromise is detected

    • ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)