VULNpocalypse
MediumBreach / campaignMonitoring

Warp breach: AI agent traces and telemetry exposed through an attack on a third-party vendor

Warp says an attack on an unnamed vendor exposed agent traces and telemetry for about 1% of users. Rotate any secret that passed through a Warp agent session.

Published
Updated
Exploitation
Yes. Warp describes an “active and narrow-banded exploitation” of a vendor, detected on a Friday (23 October per Wiz)

What happened

Warp started as a terminal and now sells itself as an agentic development environment, where AI agents run commands, read files and write code. Its website claims at least 800,000 users (BleepingComputer).

  • Friday, 23 October 2026: Warp became aware of the attack. CEO Zach Lloyd wrote on X: “On Friday, we became aware of what we believe to be an active and narrow-banded exploitation of a vendor in Warp’s infrastructure.” He said Warp “detected the operation within hours” (BleepingComputer). Wiz dates Warp’s incident to 23 October (Wiz).
  • 27 October: BleepingComputer reported the disclosure. Agent traces and telemetry were “identified as potentially affected data”. Lloyd estimated that “roughly 1% of Warp users may have been impacted”. Warp notified the users it identified, engaged CrowdStrike and told law enforcement (BleepingComputer).

How the attacker got in. Through a third-party vendor in Warp’s infrastructure. Warp has not named the vendor or described the vulnerability. Early analysis cited by BleepingComputer suggests “an agent swarm” using “a very sophisticated penetration and escalation technique” (BleepingComputer). Wiz quotes Warp pointing to a “third-party vendor dependency” (Wiz).

What was in the data: not disclosed. Warp has not said whether the traces held source code, prompts or credentials (BleepingComputer). No attacker has been named, and Warp has not published a formal notice or post-mortem on its blog as of 2 November 2026; the public statement is Lloyd’s X post.

Why the plan you are on matters. Warp’s privacy documentation says that with telemetry on, Warp “may also collect AI interactions and console inputs” that power its AI features. Free-plan users must keep telemetry on to use AI. Paid users can opt out and keep AI. Business and Enterprise plans are under a zero data retention agreement, where “no AI interaction or console data is ever collected”. Secret Redaction, which masks matches before AI requests are sent, is off by default (Warp docs). The Cloud Security Alliance notes these settings do not prove what was in the breached dataset, but they show the impact can differ by plan and configuration (CSA research note).

Warp is one of nine platforms in Wiz’s “Black October” count; see our Black October roundup. Unlike Railway, Zeabur or OpenCode, nothing Warp has said points to stored API keys or environment variables being taken.

Am I affected?

  1. Did Warp email you? Warp says it has notified the users it identified as affected (BleepingComputer).
  2. Which plan and settings did you run between September and 23 October? Open Settings > Privacy (or search “privacy” in the Command Palette) and check “Help improve Warp” (Warp docs): - Free plan with AI in use: AI interaction and console data could have been collected. - Paid plan with “Help improve Warp” on: same. - Paid plan with it off, or Business or Enterprise under zero data retention: Warp says that data is not collected.
  3. Was Secret Redaction on? If not, secrets in what the agent saw were sent unmasked.
  4. What did your agents touch? Think about sessions where an agent ran env, printenv, cat .env, kubectl get secret, aws configure list, gh auth status, or read config files with connection strings. Anything printed there is what a trace would hold.

What to do now

  1. Rotate secrets that appeared in agent sessions, starting with cloud keys, database URLs with passwords, CI tokens and GitHub tokens. The CSA note recommends this as a precaution while the trace contents are unknown (CSA research note).
  2. Turn on Secret Redaction in Warp, and on paid plans consider turning off “Help improve Warp” (Warp docs). Pattern-based redaction will not catch every secret, so do not rely on it alone.
  3. For teams, confirm in your contract whether you are under Warp’s zero data retention terms, and ask Warp which vendor was involved and whether your users were in the 1%.
  4. Expect phishing that uses your own context. Warp told users to watch for unsolicited messages (BleepingComputer). A message quoting a real command, repo name or hostname from your sessions is a sign the sender has trace data. Questions go to security@warp.dev (Warp docs).

Sources