Warp says an attack against a third-party vendor in its infrastructure may have exposed agent decision logs and telemetry data belonging to users of its agent development environment. Founder and CEO Zach Lloyd estimates that approximately 1% of Warp users may have been affected, while outside cybersecurity experts assist with the investigation.
Warp investigates third-party vendor attack
Warp is a developer tool that began as a modern terminal and evolved into an agent development environment (ADE). The platform allows developers to direct AI agents to write and test code and deploy software.
Its workspace combines a terminal, code editor, task orchestration features and tools for reviewing agent activity. According to the project website, Warp has at least 800,000 users.
“On Friday, we became aware of what appears to be active and narrow-scope vendor exploitation of Warp’s infrastructure,” Lloyd said.
“We were able to detect the operation within hours and remediate it to reduce the impact,” the CEO added.
Scope of exposed data remains unclear
Warp identified agent traces and telemetry as potentially affected data. However, the company has not disclosed whether the incident exposed source code, prompts, credentials or other sensitive information.
An analysis of the incident suggests that the attack involved a “swarm of agents” using “highly sophisticated intrusion and escalation techniques.” Warp said it has contacted third-party vendors about the vulnerability, although it did not provide further details.
The company has notified users it identified as affected. Cybersecurity firm CrowdStrike is assisting with the investigation, and Warp is also providing information to law enforcement.
Incident follows OpenCode breach
The Warp incident follows a breach at the AI coding platform OpenCode. The company notified users last week that attackers had compromised stored API keys used by external providers.
That incident affected approximately 1.4% of OpenCode users and led to fraudulent charges of up to $1,700 for some customers.
Warp users are advised to remain vigilant, monitor account activity and treat unsolicited communications with caution.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com