Treat coding-agent traces and telemetry as sensitive data: they can hold whatever the agent saw, including tokens and command output
The Warp incident is a reminder that an agent's logs are only as safe as the vendor storing them.
- Give agents short-lived, narrowly scoped credentials, and load secrets from a secret manager or environment rather than pasting them into prompts or chat.
- Check what your agent tools upload: trace sharing, telemetry and cloud history settings, and whether your plan offers zero data retention.
- Keep a list of which keys each agent session could see, so you can rotate the right ones quickly if the vendor reports a breach.
Sources: Zach Lloyd (Warp CEO) on X: statement on vendor exploitation (Oct 26), reposted by @warpdotdev