Warp says it detected the attack within hours and mitigated its impact. Agent decision logs and telemetry were potentially exposed, and CrowdStrike is helping investigate.
Warp has notified users identified as affected by a third-party vendor breach that potentially exposed agent decision logs and telemetry. Founder and CEO Zach Lloyd estimates that roughly 1% of Warp users may have been affected, with the investigation still under way.
BleepingComputer said on October 27 that Warp began as a terminal—a tool for entering computer commands—and evolved into a workspace where developers direct superintelligence (SI) agents to write and test code and deploy software. The potentially exposed agent traces are records of those agents’ decisions.
Warp’s security documentation says enabled telemetry—the monitoring data its software collects—includes feature-use metrics, crash reports, error tracking and performance measurements. It also says agent actions are logged with full context when cloud conversation storage is enabled.
For cloud agents running on a customer’s own infrastructure, Warp says session transcripts and model requests and responses still pass through Warp and can include code context from agent interactions.
Warp has not clarified which fields were potentially exposed in this incident, including whether the information contained source code, prompts—the instructions users give agents—or credentials such as passwords or access keys.
Lloyd said Warp became aware on Friday, October 23, of what it believed was active, narrowly targeted exploitation of a vendor in its infrastructure. The company detected the operation within hours and took steps to remedy the problem and limit its impact.
Warp contacted the vendor about the vulnerability. Warp has not publicly named the vendor, described the vulnerability or detailed the mitigation.
BleepingComputer also cited an assessment suggesting that the attack used an “agent swarm”—multiple automated agents working together—with techniques for breaking into systems and gaining greater access. That remains an assessment of the attack mechanism, rather than a confirmed finding.
Warp has informed law enforcement and engaged cybersecurity firm CrowdStrike to help investigate. Lloyd’s estimate remains preliminary as outside specialists work to establish the breach’s scope.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min
