According to TechRadar, a seller on an English-language cybercrime forum posted on 16 September 2026 claiming to have full Mistral AI source code for sale. The seller, using the handle "mrwho," priced the material in Monero and tried to move buyers to Session or Telegram. Mistral AI has stated it has found no evidence to support the claim.
The episode is tangled because Mistral was already breached in May 2026 through the TeamPCP supply-chain campaign, and at least four repository names from mrwho's listing overlap with the May dump. The clean way to test the new claim is whether the September material contains any data dated after 12 May 2026.
- A seller using the handle "mrwho" posted a sale listing on 16 September 2026.
- Mistral AI says it has found no evidence of new unauthorised access.
- The earlier May 2026 breach via the Mini Shai-Hulud worm is undisputed.
- The TeamPCP group advertised about 450 repositories, ~5GB, for $25,000 in May.
- At least four repository names appear in both the May and September postings.
- The clean test for a real new breach is post-12 May data in the September archives.
What is actually known
Mistral's own advisory MAI-2026-002 confirms that an automated worm compromised versions of its SDKs for a few hours on 11 and 12 May 2026. The worm, attributed to the TeamPCP group, spread through the Mini Shai-Hulud supply-chain campaign from compromised TanStack packages. Microsoft Threat Intelligence found that a poisoned Mistral Python package fetched a second-stage credential stealer.
In May, TeamPCP advertised around 450 repositories (~5GB) for $25,000 and threatened to dump them for free within a week if no buyer appeared. The mrwho post in September overlaps with at least four of those repository names according to FrenchBreaches, which examined the 339-file tree mrwho shared.
What is disputed is whether the September listing is a re-cut of the May dump or new material.
Why the account profile matters
The CyberSec Guru observed that the mrwho account joined the forum in September 2026, carried only four posts, and held a reputation score of 30, even while its profile showed a top-tier "GOD User" rank. A newly opened account wearing senior credentials is consistent with several possibilities: a scam in progress, an alias controlled by the original operator, or an agent fronting for a more established seller.
Separately, Mistral told BleepingComputer that the May attackers broke into an internal codebase management tool and briefly poisoned some SDK packages, while stressing that its hosted services, managed user data, and research environments were not affected. Mistral separately told HackRead that the access in May was limited to certain non-core repositories. No equivalent confirmation has been issued for the September claim.
Our analysis
For a reader of this site, the practical question is not whether Mistral was breached again. It is whether you should change your behaviour based on a forum post. The defensible answer is: do not, and here is why.
Source-code sales on cybercrime forums are rarely fresh. The usual cases are old leaks rebranded, partial leaks inflated with public repo content, or outright scams that take Monero and vanish. The September listing fits that pattern on the available evidence. The repository names overlap, the seller is brand new, and no post-May data has surfaced.
The reseller angle is real even if Mistral is not your stack. If you resell or white-label any AI-powered tool, the same supply-chain risk that hit Mistral in May applies to you. SDKs you depend on can be poisoned at the package level. The defensive posture is the same: pin dependency hashes, watch for unexpected package updates, and subscribe to the security advisories of every vendor in your build chain. The cost of those habits is low. The cost of skipping them, for a reseller who promises uptime to clients, is much higher.
The verification test for any future claim of this kind is simple. If a "new" leak contains only pre-incident timestamps, it is a resale. If it contains valid credentials or commits dated after the cleanup, it is a real new incident. That is the test any security team would apply, and it is the test our readers can hold vendors to.
A worked example
Say you are a small agency and you ship a client feature on top of a third-party AI API. A week from now, a forum post claims to have that vendor's source code for sale. Your first move is not to panic. It is to check the vendor's advisory feed, and check whether the listed files match the vendor's already-disclosed incident. If dates line up, it is a re-cut. If they do not, escalate to the vendor in writing and ask for a public statement. Either way, the response time is measured in hours, not weeks.
What to watch next
Watch for two things. First, whether Mistral publishes a forensic comparison of the September material against the May dump. Second, whether major AI vendors draw a clean public line between training infrastructure and product SDKs, so future leaks can be triaged faster. Both moves would meaningfully reduce the noise around incidents like this.
Key takeaways
- Mistral disputes the September 2026 breach claim; the May 2026 breach is confirmed.
- The September listing overlaps with the May dump on at least four repository names.
- Source-code sales on cybercrime forums are often rescuts or outright scams.
- For resellers, the operational lesson is supply-chain hygiene for any AI SDK you depend on.
- Demand post-event data before treating any "new" leak as a real incident.
Frequently asked questions
Was Mistral breached again in September 2026?
Mistral says it has found no evidence. The September listing overlaps with the May dump on at least four repository names.
How can I tell if a "new" leak is a rescut?
Check the commits, files, and credentials inside. If nothing is dated after the prior incident, it is a resale.
What should a reseller do in response?
Pin dependency hashes for any SDK you ship, and subscribe to vendor security advisories. Treat any supply-chain claim as a cue to harden, not panic.
Does the September claim change how I should host WordPress or cPanel sites?
Not directly. But if you bundle AI features, the same supply-chain hygiene applies to your AI dependencies.