Warp says an attack that looks like an AI agent swarm got in through a vendor and reached users' agent logs

Warp started as a terminal and now pitches itself as an agentic development environment, where developers direct AI agents to write, test and deploy code. On 26 October 2026 its CEO, Zach Lloyd, disclosed a breach, and security press picked it up the next day.

What happened

Lloyd says that on Friday 23 October Warp became aware of "an active and narrow-banded exploitation of a vendor in Warp's infrastructure". The company says it detected the operation within hours and was able to remediate and mitigate the impact.

How it got in

In Lloyd's words, the attack "appears to have come from an agent swarm using a very sophisticated penetration and escalation technique, likely starting with a hole in a vendor dependency". That is Warp's current read, not a finished investigation. Neither the vendor nor the vulnerability has been named.

What was taken

Lloyd says the attackers ultimately accessed "a limited amount of agent trace and telemetry data". Agent traces are the record of what an AI agent did in a session. Warp hasn't said whether those traces included source code, prompts, credentials or anything else sensitive.

Who was hit

Warp's upper bound is roughly 1% of its users. It says it has notified everyone it has positively identified as impacted, and that they will get instructions on what to do.

What Warp is doing

Warp says it has been in touch with the vendor about the vulnerability, is working with CrowdStrike on a fuller investigation, and has brought in law enforcement. Lloyd apologised and said the company will keep posting updates.

Our take

This is our opinion. The new thing here isn't a vendor breach, it's what leaked: agent traces. A trace can quote code, commands and whatever secrets passed through a session, yet many tools store traces like debug logs. If you use any agent tool with cloud traces, find out what is kept, for how long and with which vendors. Keep secrets out of agent sessions, and rotate any key that showed up in one.