Hackers reached Warp's AI agent logs through a vendor

Warp, the app that started as a slick terminal and now calls itself an environment for working with AI agents, has admitted to a breach. Someone got in through a weakness at one of the third party vendors in its infrastructure and reached agent logs and user telemetry.

Warp spotted the problem on Friday, October 23, and founder and CEO Zach Lloyd went public about it on X on Monday. He says the attack was caught within hours and shut down, and that at most roughly 1% of users may have been affected. Warp's own site claims more than 800,000 users, so that could mean several thousand accounts.

The most interesting part of Lloyd's explanation is the attacker. He says it appears to have been an agent swarm using a very sophisticated penetration and privilege escalation technique, most likely starting from a hole in a vendor dependency. Warp has not named the vendor or the vulnerability.

The key question is still open. Warp has not said whether the leaked traces contained source code, prompts, API keys or passwords, and agent logs usually hold exactly what the agent saw and did inside a project. Affected users have been notified and will get instructions, CrowdStrike (a major US cybersecurity firm) is helping with the investigation, and law enforcement has been brought in.

If you use Warp and got that email, rotating any keys your agent touched is a cheap precaution. Agents write the code, agents break in, and we pay for both subscriptions.