An intrusion in a few hours
On 12 May 2026, Mistral AI published a security advisory (reference MAI-2026-002) confirming that some of its software development kits (SDKs) had been affected by a software supply chain attack. The incident is part of a broader campaign, dubbed "Mini Shai-Hulud" and attributed to the group TeamPCP, which first compromised TanStack packages on 11 May, a widely used collection of open source libraries for building web interfaces.
The timeline spans just a few hours. Compromised versions of Mistral's JavaScript SDKs were published on the npm registry on the night of 11 to 12 May, between approximately 22 h and 1 h UTC (from midnight to 3 h, Paris time). A compromised version of the Python SDK, "mistralai" 2.4.6, remained online on PyPI between approximately 0 h and 3 h UTC on 12 May.
The two vectors did not have the same level of danger. According to Mistral, the compromised npm packages were not functional. The Python package, however, contained a backdoor that executed upon import on Linux machines. It was a credential stealer, targeting cloud keys, continuous integration tokens, GitHub accesses, and API keys. Microsoft Threat Intelligence observed that it downloaded a second malicious payload. PyPI subsequently quarantined the entire "mistralai" project.
A spectacular claim
In the days that followed, criminals claiming to be TeamPCP stated on a cybercrime forum that they held nearly 450 private code repositories from Mistral, approximately 5 gigabytes, offered for sale for 25 000 dollars, with the threat of publishing everything for free if no buyer was found within a week. Among the listed repository names were mistral-inference-internal, chatbot-security-evaluation, and pfizer-rfp-2025. The latter name suggested projects related to clients, although no evidence indicated that Pfizer itself had been compromised. At the time of the claim, no samples had been published and the leak had not been independently verified.
Mistral's measured response
Mistral acknowledged the facts while delimiting the scope. Its security advisory indicates that a developer workstation was affected and that no evidence shows a compromise of its infrastructure. In a statement to BleepingComputer, the company confirmed that attackers had compromised a code management system and "contaminated some of [its] SDK packages for a brief period," while assuring that neither its hosted services, user data, nor its research and test environments had been affected. It specified to HackRead that only certain non-essential repositories had been accessed.
This communication aims to reassure a clientele that includes major accounts and government agencies. In enterprise AI, the perception of a breach can cost more than the breach itself.
A breach that does not spare the giants
The incident is not unique to the French champion. On 13 May, OpenAI indicated that two employee workstations had been affected by the same TanStack attack. A limited number of credentials were stolen from some internal code repositories, and the company proactively renewed its signing certificates, requiring users of its macOS applications to update them. The campaign also targeted packages from UiPath, Guardrails AI, and OpenSearch.
That is where the real lesson lies. The supply chain attack, of which the SolarWinds case revealed in December 2020 remains the archetype, exploits the interdependence of the entire software industry. No company develops all its code from scratch: all rely on third-party libraries, open source frameworks, and continuous integration tools. Compromising one of these links means reaching all those who depend on it.
The paradox of a deceptive sovereignty
The incident raises an uncomfortable question for the narrative of European digital sovereignty. At the time of the attack, Mistral was valued at 11,7 billion euros, following a September 2025 funding round led by Dutch company ASML, which invested 1,3 billion euros. Since then, the company raised 3 billion euros on 8 September 2026, for a valuation of over 21 billion.
But this champion, like all others, builds its software on foundations it does not control. Technological sovereignty is not limited to training a language model in Europe. It also requires mastering, or at least rigorously auditing, the entire software chain that supports it, down to open source dependencies and publishing tools. In this area, Europe depends, like everyone else, on globalized ecosystems.
A case that resurfaces in September
On 16 September 2026, a seller calling himself "mrwho" put up for sale on a cybercrime forum what he presented as Mistral's complete source code, claiming the company had been hacked again. Mistral responded that it had found "no evidence" of a new unauthorized access. However, several repository names in the listing overlapped with the list published by TeamPCP in May, suggesting a resale of data stolen in the spring rather than a new intrusion. No files dated after the May incident have been publicly shown.
A test for the European cybersecurity doctrine
The case comes as the European Union strengthens its cybersecurity requirements, with the NIS 2 directive for critical entities and the Cyber Resilience Act for digital products. The challenge is real: imposing systematic audits of every open source component would increase costs and slow innovation, but doing nothing means accepting permanent exposure. Between these two extremes, priority must be given to securing the most sensitive links: publishing accounts, continuous integration tokens, and developer workstations.
On an operational level, the May incident will likely remain limited: no known user data leak, no model compromise, an exposure window of a few hours, and a rapid response. Its symbolic scope is broader. The AI race is not only about model power or funding volume, but also about the robustness of often invisible infrastructures. Sovereignty is not decreed: it is built layer by layer, from the model down to the smallest software library.
Sources: Mistral AI, security advisory MAI-2026-002; BleepingComputer, 14 May 2026; Cybernews, 14 May 2026; LiteLLM, analysis of the mistralai package 2.4.6; OpenAI, response to the TanStack attack, 13 May 2026; TechRadar via Yahoo, 22 September 2026; Mistral AI, Series C funding round, 9 September 2025; Reuters, 8 September 2026.
