Australian Federal Police charged two men in Perth on 26 August 2026 with 14 offences tied to TeamPCP, a hacking group accused of spreading malicious code through open source tools used by OpenAI, GitHub and Mercor.
They appeared in Perth Magistrates Court on 27 August. Police say the group stole more than 500,000 credentials and breached over 1,000 organisations; whether the United States will seek extradition remains unresolved.
Trivy was built to find vulnerabilities in code. Police say someone turned it into a way to plant one.
On 27 August 2026, two men appeared in Perth Magistrates Court accused of doing exactly that through TeamPCP, the group Australian authorities blame for a software supply chain attack that spread through open source tools and reached OpenAI, GitHub and Mercor. Australian media identified the accused as Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21.
The scanner that was supposed to reduce risk became the risk.
Thousands of companies run the same scanner inside their build systems. A poisoned version could sit unnoticed in a build log, harvesting credentials while the code it checked shipped on schedule.
That is the gap this case opens. Users were not targeted individually; they inherited the risk from a tool they trusted to reduce it.
A security tool turned against its users
The Australian Federal Police searched homes in Cottesloe, Hamilton Hill and Mandurah before laying a combined 14 charges on 26 August. The accused are described as principal participants in TeamPCP, not peripheral figures.
An AFP spokesperson described the alleged operation as a sophisticated syndicate built on credential theft through malicious open source software. Victims were then extorted for ransom, police said.
The alleged haul exceeded 500,000 credentials. Investigators also suspect the group breached the European Commission’s cloud infrastructure. Those stolen keys and tokens opened access to cloud accounts and code repositories.
FBI Cyber Division Chief Brett Leatherman has characterised multinational law enforcement operations as imposing costs across the criminal ecosystem. In a statement about Operation Riptide, a 60-day FBI campaign targeting cybercriminals, Leatherman said: “Arrests, extraditions, infrastructure takedowns, and seizures each imposed cost at a different point in the criminal ecosystem.” The TeamPCP case is part of this broader international enforcement effort, with the FBI working in parallel with Australian authorities.
The full picture remains provisional. The FBI has not said whether the US Justice Department will seek extradition, and the AFP has not released the charge sheets.
The charges rest on Australia’s Cybercrime Act. Section 477.1 criminalises unauthorised access with intent to commit a serious offence. It carries a maximum of 10 years’ imprisonment. The neighbouring sections cover data impairment and communication disruption.
What changed is the signal, not the architecture.
The mechanism matters. A CI/CD pipeline pulls the scanner as a trusted step. A developer whose build ingested the poisoned release would not see the theft happen. The first sign might be an unrecognised login from a stolen cloud token. The sequence below shows how one tampered package becomes cloud access.
| Entity | Current rule | New rule | Effective date |
|---|---|---|---|
| Section 477.1, Criminal Code Act 1995 (Cth) | Criminalises unauthorised access to data with intent to commit a serious offence | Applied to the alleged credential theft and cloud access | Existing law; applied 26 August 2026 |
| Section 477.2 | Criminalises unauthorised modification of data causing impairment | Applied to alleged tampering with open source build scripts | Existing law; applied 26 August 2026 |
| Section 477.3 | Criminalises unauthorised impairment of electronic communication | Applied to alleged disruption of developer and AI platforms | Existing law; applied 26 August 2026 |
| Source: Australian Federal Police; Criminal Code Act 1995 (Cth) | |||
The structural gap the arrests expose
Open source code now runs AI platforms and cloud infrastructure, yet its security still depends on volunteer maintainers and ad hoc review. A single compromised package can cascade across borders. This case shows how far that cascade can travel. Software bills of materials are still the exception, not the rule.
Australia’s legal framework is technology-neutral. Sections 477.1 to 477.3 criminalise access and impairment without requiring specific supply chain controls. Practical security guidance comes from the Australian Cyber Security Centre, not from statutory mandates.
That gap has turned supply chain defence into a race. The AFP and the Cyber Security Centre coordinate with the FBI and CISA, while Microsoft, Google Cloud and GitHub invest in package signing and provenance tracking. OpenAI’s security teams describe the same intersection of compromised tooling and misaligned agents as a failure of alignment, and they have pushed for tighter network access.
Trust was the vulnerability.
Trivy was written to catch flaws before they shipped. If the scanner itself can be poisoned, the trust model that thousands of teams rely on was already broken. The arrests expose it; they do not repair it.
Beyond the headline
The Bigger Picture
Open source software runs on gift economics: maintainers give away code, companies take it, nobody owns the outage. A single bad merge moves into thousands of build systems without a contract attached. That absence of responsibility is not a bug in the community; it is its structure.
The Money Trail
Credential markets operate on the same logic as any exchange: high-value access clears fast. Compromised tokens and API keys are priced by the cloud account they unlock, then resold. Until identity is tied to hardware and exchanges stop accepting stolen keys as inventory, the incentive holds.
The Reach
American firms will not feel this as an Australian story. A compromised scanner used in CI/CD workflows is a hole in their own stack. Security and compliance teams will face scrutiny over how poisoned dependencies reached their systems and whether customer data or intellectual property was exposed.
The security work starts now
With two men before a Perth court and victim notifications still pending, four groups face decisions that will not wait for a verdict.
- Western enterprise security manager using open-source AI/developer tools
You need to audit your CI/CD pipelines for exposure to the tools named in the charging documents. Check the Australian Cyber Security Centre’s advisory pages at cyber.gov.au for guidance on supply chain security and rotate credentials tied to Trivy, LiteLLM or other affected scanners. A software bill of materials should show which dependencies touched customer data.
- US/EU regulator or policy professional focused on cyber resilience
This case gives you a concrete fact pattern for testing whether existing rules are enough. CISA’s software supply chain guidance at cisa.gov sets current federal expectations; compare it with the gaps in open source maintenance. An extradition decision will test cross-border cooperation before any new law does.
- Investor with holdings in AI or cloud service providers
Ask portfolio companies one question: can they produce a software bill of materials for the tools that touch customer data? Incident response costs and regulatory fines will hit companies that cannot answer. The arrest is not the end of the risk; victim notifications are still to come.
- Australian legal professional specializing in cybercrime
Watch the Perth Magistrates Court committal schedule over the coming weeks. Detailed charge sheets will reveal which sections of the Criminal Code the prosecution is anchoring to: 477.1, 477.2 or 477.3. That will shape how Australian courts treat software supply chain compromises.
Explainer
- Trivy
- Trivy is an open source vulnerability scanner that checks container images and code for known security flaws. It is maintained by Aqua Security and integrated into many CI/CD pipelines. In this case investigators say a compromised version turned a defensive tool into a vehicle for stealing credentials.
- TeamPCP
- TeamPCP is the name Australian and US authorities use for the cybercriminal group charged with compromising open source software tools. The group is alleged to have stolen credentials and used them to reach developer and AI platforms. Its members are accused of operating from Western Australia, the first such case to reach charges in the country.
- Software supply chain attack
- A software supply chain attack modifies a trusted component so that every downstream user inherits the risk. The attacker typically injects malicious code into a package, build script or container image that developers pull automatically. These attacks are dangerous because they bypass normal perimeter controls and sit inside trusted processes.
- CI/CD pipeline
- A CI/CD pipeline is the automated chain that builds, tests and ships code whenever developers make changes. It pulls dependencies from registries and runs scripts with access to secrets and cloud credentials. A compromised dependency in one of these pipelines can steal those secrets without the developer noticing.
- Cybercrime Act
- The Cybercrime Act is the Australian legislation that amended the Criminal Code to cover computer offences. It introduced sections 477.1 to 477.3, which criminalise unauthorised access, modification and impairment of data and communications. These are the provisions under which the TeamPCP arrests are being prosecuted.
RELATED STORIES
