Warp (AI terminal / agentic dev environment) breached through a third-party vendor: agent logs and telemetry of about 1% of users exposed

Warp says attackers exploited an unnamed third-party vendor in its infrastructure. Warp found out on Friday 2026-10-23 and says it detected and contained the attack within hours. CEO Zach Lloyd estimates roughly 1% of Warp users are affected (Warp claims 800,000+ users). The exposed data is agent decision logs/traces and user telemetry. Warp has not said whether that included source code, prompts, terminal output or credentials. Warp describes the attack as an 'agent swarm' using a sophisticated penetration and escalation technique. CrowdStrike is investigating and law enforcement has been told. Affected users have been notified. Developers who use Warp's AI agents are at risk, because agent traces can contain secrets, commands and code from their sessions. This comes a week after the OpenCode breach that exposed stored provider API keys. Indicators of compromise and the vendor's identity: unknown.

Summary written from the sources below. Check the originals before acting.