Warp: Contractor Attack Affected AI Agent Logs and Telemetry

On October 23, 2026, the Warp team discovered signs of a cyberattack on one of the third-party providers involved in the platform's infrastructure. This was reported by founder and CEO Zach Lloyd. According to him, the attack was detected within a few hours, the issue was resolved, and the impact was contained. Attackers may have gained access to AI agent decision logs (agent traces) and user telemetry. The CEO's preliminary estimate: the incident affected about 1% of users.

Warp began as a terminal for developers but over time grew into an Agentic Development Environment (ADE). The platform combines a terminal, code editor, task management tools, and agent work verification. Through it, developers can task AI with writing and testing code, as well as deploying applications. According to the official website, Warp has at least 800,000 users. The current incident differs from a typical leak in that what was compromised was not just accounts but the internal logs of agent operations—specifically how the AI made decisions in users' tasks.

In practice, this means that the data the platform collects for debugging and improving agent performance is at risk. The company has not yet specified whether the compromised data contained project source code, prompts, credentials, or other confidential information. Analysis of the incident showed that the attackers used an "agent swarm" and a sophisticated hacking technique with subsequent privilege escalation. Technical details of the attack are not disclosed. Warp representatives have already contacted the affected provider regarding the vulnerability exploited by the hackers.

What remains unknown: the exact composition of the stolen data and whether user secrets were among it. There is also no data on exactly how the attackers gained access to the contractor's infrastructure and what measures Warp took to protect affected users.