Warp discloses third-party vendor breach exposing AI agent logs, telemetry

Warp, an AI-powered developer terminal that evolved into an agentic development environment, disclosed that attackers compromised a third-party vendor inside its infrastructure, exposing AI agent decision logs and user telemetry data.

Founder and chief executive Zach Lloyd said Warp first became aware of the exploitation on a Friday and detected the activity within hours, moving quickly to contain it.

What happened

Warp's platform lets developers direct AI agents to write and test code and deploy software inside a workspace built around the company's agentic development environment.

Early analysis attributed the intrusion to a coordinated agent swarm that relied on what was described as a very sophisticated penetration and escalation technique.

Lloyd said Warp contacted the vendor about the vulnerability, though no further details about the vendor or the flaw have been shared, and the company has notified the users it identified as affected.

Impact

Warp has not clarified whether the exposed agent traces and telemetry included source code, prompts, credentials or other sensitive information.

Lloyd estimated that roughly 1% of Warp users may have been impacted while the investigation into the exposure's scope continued.

Response

Warp engaged the cybersecurity firm CrowdStrike to assist with the investigation and informed law enforcement authorities about the incident.

The company also advised users to remain vigilant, monitor account activity, and treat unsolicited communications with increased caution.

Lessons for security leaders

Agentic developer tools route a user's commands, file paths and anything pasted into a prompt through connected infrastructure, so logs generated by those agents can carry the same sensitivity as source code or credentials even when a vendor, not the core platform, is compromised. Security teams that rely on AI coding agents should treat vendor risk reviews as covering agent log pipelines, rotate any credentials or tokens used inside affected tools, and confirm what data retention and redaction settings apply to their account tier before an incident, not after.