Warp says vendor attack reached agent trace and telemetry data, with up to roughly 1 per cent of users possibly affected

TLDR

• Warp CEO Zach Lloyd says an attack via a vendor accessed a limited amount of agent trace and telemetry data.¹²
• Lloyd puts the upper bound at roughly 1 per cent of users; CrowdStrike is assisting and law enforcement is engaged.¹²
• BleepingComputer reports Warp did not say whether source code, prompts or credentials were exposed.²

Warp CEO Zach Lloyd wrote on X on 26 October: "On Friday, we became aware of what we believe to be an active and narrow-banded exploitation of a vendor in Warp's infrastructure."¹ He said the company detected the operation within hours and was able to remediate and mitigate the impact.¹ BleepingComputer reports that agent decision logs and telemetry data belonging to users of Warp's agentic development environment were exposed in an attack on a third-party vendor in the project's infrastructure.² BleepingComputer says Warp's website states the platform has at least 800,000 users.²

On the attacker, Lloyd wrote that the attack "appears to have come from an agent swarm using a very sophisticated penetration and escalation technique, likely starting with a hole in a vendor dependency, and ultimately accessing a limited amount of agent trace and telemetry data."¹ The agent swarm description is Lloyd's characterisation of the attack, and BleepingComputer reports it as the result of an analysis of the incident.² Lloyd said Warp has been in touch with the vendor about the vulnerability, and BleepingComputer reports that no details have been shared.¹²

Lloyd said Warp has notified anyone it positively identified as impacted, believes an upper bound of roughly 1 per cent of Warp users may have been impacted, is working with CrowdStrike on a more extensive investigation and has engaged law enforcement.¹ He added that impacted users will receive instructions on action they need to take and that Warp will continue to post updates.¹ BleepingComputer reports that external experts are helping with the ongoing investigation and that Warp users are advised to remain vigilant, monitor account activity and treat unsolicited communications with increased caution.²

Lloyd's post refers to agent trace and telemetry data, while BleepingComputer describes agent decision logs and telemetry data.¹² BleepingComputer reports that Warp did not clarify whether the exposed information included source code, prompts, credentials or other sensitive details.² BleepingComputer also notes that the incident follows one at OpenCode, which notified users the previous week that a security breach exposed stored API keys used with external providers.²

Why it matters: the sources describe a vendor in the infrastructure of an agentic coding tool as the route to agent trace and telemetry data, while the agent swarm account remains Lloyd's own characterisation in an investigation that is still ongoing.¹²