Warp says attackers exploited a vendor in its infrastructure and accessed agent trace and telemetry data
Warp (terminal and agent platform)
On Oct 26 2026, Warp CEO Zach Lloyd disclosed that on Friday Oct 23 the company found what it believes was an active, narrow exploitation of a vendor in Warp's infrastructure. Warp says it detected the operation within hours and remediated it. According to Lloyd, the attack appears to have come from an agent swarm using a sophisticated penetration and escalation technique, likely starting with a hole in a vendor dependency, and it accessed a limited amount of agent trace and telemetry data. Warp puts the upper bound at roughly 1% of its users, has notified everyone it positively identified as impacted, is working with CrowdStrike on a fuller investigation and has engaged law enforcement. The vendor and the vulnerability haven't been named.
Why this severity: Limited agent trace and telemetry data for up to ~1% of users; vendor and vulnerability not yet named
- Started
- Oct 23, 2026
Affected
- Warp users whose agent trace and telemetry data was accessed (upper bound roughly 1% of users, per Warp)
Fixed in
No fixed release yet
Timeline2
Warp CEO Zach Lloyd discloses the incident: an agent swarm likely got in through a hole in a vendor dependency and accessed a limited amount of agent trace and telemetry data, affecting at most roughly 1% of Warp users. Identified users have been notified; CrowdStrike is investigating and law enforcement is engaged.
Warp detects what it believes is active, narrow exploitation of a vendor in its infrastructure and remediates it within hours.
Advisories2
News & write-ups1
Posts1
On Friday, we became aware of what we believe to be an active and narrow-banded exploitation of a vendor in Warp's infrastructure. We detected the operation within hours and were able to remediate and mitigate the impact. We have been in touch with the vendor about the vulnerability. Everyone who uses Warp places a lot of trust in us and that’s not something we take lightly. I’m very sorry that this incident has occurred. The attack appears to have come from an agent swarm using a very sophisticated penetration and escalation technique, likely starting with a hole in a vendor dependency, and ultimately accessing a limited amount of agent trace and telemetry data. We have been working over the weekend and we have notified anyone who we have positively identified as impacted. As of today, we believe an upper bound of roughly 1% of Warp users may have been impacted. We are working closely with the team at Crowdstrike to do a more extensive and comprehensive investigation and have engaged law enforcement. Anyone who has been impacted will receive instructions from us on action they need to take. We will continue to post updates as we learn more.
Notes & caveats
Only source so far is the CEO's statement on X (reposted by @warpdotdev). Warp hasn't said which vendor, which data fields, or whether secrets that appeared in agent traces were exposed.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
