# Warp says attackers exploited a vendor in its infrastructure and accessed agent trace and telemetry data · pwn.watch > On Oct 26 2026, Warp CEO Zach Lloyd disclosed that on Friday Oct 23 the company found what it believes was an active, narrow exploitation of a vendor in Warp's infrastructure. Warp says it detected the operation within hours and remediated it. According to Lloyd, the attack appears to have come from an agent swarm using a sophisticated penetration and escalation technique, likely starting with a hole in a vendor dependency, and it accessed a limited amount of agent trace and telemetry data. Warp puts the upper bound at roughly 1% of its users, has notified everyone it positively identified as impacted, is working with CrowdStrike on a fuller investigation and has engaged law enforcement. The vendor and the vulnerability haven't been named. Page: https://pwn.watch/i/warp-vendor-exploitation-agent-telemetry-oct-2026 · generated 2026-10-26T23:24:06.493Z ## Status - Severity: medium · status: live · patch: partial - Product: Warp (terminal and agent platform) - Started: 2026-10-23 - Affected: Warp users whose agent trace and telemetry data was accessed (upper bound roughly 1% of users, per Warp) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/warp-vendor-exploitation-agent-telemetry-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/warp-vendor-exploitation-agent-telemetry-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/warp-vendor-exploitation-agent-telemetry-oct-2026.json - This file: https://pwn.watch/i/warp-vendor-exploitation-agent-telemetry-oct-2026/llms.txt ## Updates (newest first) - 2026-10-26: Warp CEO Zach Lloyd discloses the incident: an agent swarm likely got in through a hole in a vendor dependency and accessed a limited amount of agent trace and telemetry data, affecting at most roughly 1% of Warp users. Identified users have been notified; CrowdStrike is investigating and law enforcement is engaged. (https://x.com/zachlloydtweets/status/2114800787716972873) - 2026-10-23: Warp detects what it believes is active, narrow exploitation of a vendor in its infrastructure and remediates it within hours. (https://x.com/zachlloydtweets/status/2114800787716972873) ## Fix brief # Security brief: Warp says attackers exploited a vendor in its infrastructure and accessed agent trace and telemetry data Source: https://pwn.watch/i/warp-vendor-exploitation-agent-telemetry-oct-2026 · status: live · severity: medium · updated Oct 26, 2026, 22:30 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is On Oct 26 2026, Warp CEO Zach Lloyd disclosed that on Friday Oct 23 the company found what it believes was an active, narrow exploitation of a vendor in Warp's infrastructure. Warp says it detected the operation within hours and remediated it. According to Lloyd, the attack appears to have come from an agent swarm using a sophisticated penetration and escalation technique, likely starting with a hole in a vendor dependency, and it accessed a limited amount of agent trace and telemetry data. Warp puts the upper bound at roughly 1% of its users, has notified everyone it positively identified as impacted, is working with CrowdStrike on a fuller investigation and has engaged law enforcement. The vendor and the vulnerability haven't been named. Severity detail: Limited agent trace and telemetry data for up to ~1% of users; vendor and vulnerability not yet named - Product: Warp (terminal and agent platform) ## Affected versions - Warp users whose agent trace and telemetry data was accessed (upper bound roughly 1% of users, per Warp) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you use Warp: watch for a notification from Warp and follow its instructions. If your agent sessions in Warp ever handled secrets (API keys, tokens, env values), consider rotating them, since agent traces can contain command output. There is nothing to update on your side yet. ## Latest updates - Oct 26, 2026: Warp CEO Zach Lloyd discloses the incident: an agent swarm likely got in through a hole in a vendor dependency and accessed a limited amount of agent trace and telemetry data, affecting at most roughly 1% of Warp users. Identified users have been notified; CrowdStrike is investigating and law enforcement is engaged. - Oct 23, 2026: Warp detects what it believes is active, narrow exploitation of a vendor in its infrastructure and remediates it within hours. ## Advisories - [Zach Lloyd (Warp CEO) on the vendor exploitation incident](https://x.com/zachlloydtweets/status/2114800787716972873) (Warp) - [Warp reposts the CEO's incident statement](https://x.com/warpdotdev/status/2114808750041383033) (Warp) ## Write-ups & news - [Wrap.dev Breached (HN discussion)](https://news.ycombinator.com/item?id=50250168) ## Caveats Only source so far is the CEO's statement on X (reposted by @warpdotdev). Warp hasn't said which vendor, which data fields, or whether secrets that appeared in agent traces were exposed. --- Machine-readable: https://pwn.watch/i/warp-vendor-exploitation-agent-telemetry-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.