Warp disclosed on Friday that an attack on a third-party vendor in its infrastructure exposed agent decision logs and telemetry data from users of its agentic development environment.
BleepingComputer reports founder and CEO Zach Lloyd estimates the attack may affect roughly 1% of Warp users. The company’s website says the platform has at least 800,000 users. Warp flagged agent traces and telemetry as potentially affected data. Warp did not specify whether exposed details covered source code, credentials, prompts or other sensitive information.
On Friday, Zach Lloyd said the company learned of an active, narrow-banded exploit involving a vendor in its own infrastructure. “On Friday, we became aware of what we believe to be an active and narrow-banded exploitation of a vendor in Warp’s infrastructure,” Lloyd stated. He said the company spotted the activity within hours and then remediated and mitigated its impact.
Lloyd said the company reached out to the third-party vendor regarding the vulnerability, but no details have been shared. Warp engaged cybersecurity firm CrowdStrike to help with the investigation, and law enforcement authorities were also informed by the platform. Outside experts are assisting with the continuing investigation.
Warp notified users identified as affected. The company told users to stay alert, watch account activity and treat unexpected messages with extra caution.
Analysis of the incident suggests an agent swarm carried out the attack using penetration and escalation techniques, according to BleepingComputer. Warp is a developer tool that began as a modern terminal before becoming an agentic development environment where developers direct AI agents to write code, run tests and deploy software. Its single workspace brings together agent review tools, task orchestration, a code editor and a terminal.
BleepingComputer reports the Warp incident follows an OpenCode security breach disclosed last week that exposed stored API keys for external providers. That breach affected about 1.4% of users and resulted in unauthorized charges up to $1,700 for some.
Join the discussion