← All incidents

Warp says an attack that exploited one of its vendors reached a limited amount of agent trace and telemetry data for up to roughly 1% of users

Incident · Warp (agentic development environment and terminal): agent trace and telemetry data · MEDIUM

Summary

Warp, the terminal and AI coding-agent app, says an attack that exploited one of its vendors reached some user data. In a post on X on Oct 26, 2026, which Warp's official account reposted, CEO Zach Lloyd wrote that on Friday (Oct 23) Warp "became aware of what we believe to be an active and narrow-banded exploitation of a vendor in Warp's infrastructure", and that "We detected the operation within hours and were able to remediate and mitigate the impact." He wrote that the attack ended up "accessing a limited amount of agent trace and telemetry data", and that "we believe an upper bound of roughly 1% of Warp users may have been impacted." Warp says it has notified everyone it has positively identified as impacted, is working with CrowdStrike on a fuller investigation and has engaged law enforcement. Lloyd wrote that the attack "appears to have come from an agent swarm". That is Warp's early view. Warp has not said whether it has been confirmed, and we found no outside confirmation. Warp has not named the vendor, has not said what the traces and telemetry contained, including whether they held code, prompts or credentials, and has not said how many people the 1% covers. Warp's website says it is trusted by more than 800,000 developers. BleepingComputer and TSN reported the disclosure on Oct 27.

Severity

Timeline

1. Oct 23, 2026 (Friday)
   Warp becomes aware of "an active and narrow-banded exploitation of a vendor in Warp's infrastructure", per CEO Zach Lloyd's Oct 26 post, which says this happened "On Friday". Lloyd says Warp detected the operation within hours. Warp has not said when the attack began.
2. Oct 24 to 25, 2026 (weekend)
   Lloyd says Warp was "working over the weekend". By the time of his Oct 26 post, he says, Warp had notified everyone it had positively identified as impacted.
3. Oct 26, 2026, 3:26 p.m. ET
   Lloyd posts the disclosure on X: a limited amount of agent trace and telemetry data accessed, an upper bound of roughly 1% of Warp users, CrowdStrike brought in and law enforcement engaged.
4. Oct 26, 2026, 3:57 p.m. ET
   Warp's official account (@warpdotdev) quote-posts it: "Reposting from our CEO".
5. Oct 27, 2026
   BleepingComputer and TSN report the disclosure. Neither adds new details about the incident from Warp beyond the post.

How it happened

Everything known comes from Lloyd's post. He wrote: "The attack appears to have come from an agent swarm using a very sophisticated penetration and escalation technique, likely starting with a hole in a vendor dependency, and ultimately accessing a limited amount of agent trace and telemetry data." The words "appears" and "likely" are Warp's. Warp says it has been in touch with the vendor about the vulnerability and is working with CrowdStrike on "a more extensive and comprehensive investigation". Warp has not disclosed the vendor's name or the vulnerability. It has not said what the agent traces and telemetry contained, including whether they held source code, prompts, command output or credentials. It has not said whether the "agent swarm" attribution has been confirmed, how it was reached, or how many users the 1% upper bound covers. Lloyd wrote that anyone impacted "will receive instructions from us on action they need to take", but Warp has not published those instructions. We won't guess at any of these details, and we will update this entry when Warp publishes them.

How to check your app

• Look for a notice from Warp. Lloyd says Warp has notified everyone it positively identified as impacted and that they "will receive instructions from us on action they need to take." Warp has not said how it sent those notices, so check the email tied to your Warp account and follow whatever Warp tells you to do.
• Warp has not said whether the traces held credentials. Until it does, if you used Warp's AI agents and an API key, token or password appeared in an agent session, for example pasted into a prompt or printed in output the agent read, consider rotating it: create a new one at the provider, update anything that uses it, then revoke the old one. Start with cloud, GitHub and AI provider keys.
• Review your telemetry settings in Settings > Privacy (or search "privacy" in the Command Palette). Warp's docs say "Help improve Warp" controls usage telemetry and, while it is on, Warp may collect AI interactions and console inputs that power its AI features. "Send crash reports" is a separate toggle. You can turn off either or both. Warp has not said whether these settings affected who was impacted.
• Know your plan's rules. Warp's docs say telemetry must be on to use AI features on the Free plan, paid plans can opt out and keep using AI, and Business and Enterprise plans are covered by a Zero Data Retention agreement under which no AI interaction or console data is collected.
• Turn on Secret Redaction in Settings > Privacy > Secret redaction. Warp's docs say it is off by default and, when on, masks secrets that match your regex patterns before terminal or AI content is sent to Warp's servers or an LLM provider. Add Warp's recommended patterns and your own for the keys you use.
• Treat unexpected messages about this incident with care, as BleepingComputer advises. Check any claim against Warp's official accounts (@warpdotdev and @zachlloydtweets on X) before acting on links or instructions.

Sources

• Zach Lloyd (Warp CEO) on X: disclosure of the vendor exploitation (Oct 26, 2026). Primary source
• Warp (@warpdotdev) on X: "Reposting from our CEO" (Oct 26, 2026)
• Warp (@warpdotdev) on X: repost of Lloyd's disclosure (Oct 26, 2026)
• BleepingComputer (Bill Toulas): Warp discloses breach exposing AI agent logs, user telemetry data (Oct 27, 2026)
• TSN: Warp Says Vendor Hack Exposed Agent Data of Up to 1% of Users (Oct 27, 2026)
• Warp docs: Privacy and data control (telemetry settings)
• Warp docs: Secret Redaction
• Warp website (user count)

Corrections and updates

None. Re-checked against every source on Oct 28, 2026.