Warp, a terminal that has grown into an agentic development environment where developers direct AI agents to write, test and deploy code, disclosed the incident in a statement from CEO Zach Lloyd on Oct 26, reposted by the company account:

• On Friday (Oct 23) Warp found what it calls "an active and narrow-banded exploitation of a vendor in Warp's infrastructure". It says it detected the operation within hours, remediated it, and has contacted the vendor about the vulnerability.
• Lloyd says the attack "appears to have come from an agent swarm using a very sophisticated penetration and escalation technique, likely starting with a hole in a vendor dependency", and ultimately accessed "a limited amount of agent trace and telemetry data".
• Warp has notified the users it positively identified as affected and puts the upper bound at roughly 1% of Warp users. CrowdStrike is helping investigate and law enforcement has been engaged. Affected users will get instructions on what to do.

Warp has not named the vendor or the flaw, or said whether the traces contained prompts, code, command output or secrets. It follows the OpenCode console breach earlier this month, another case of an AI coding platform's back end being the target. What to do: if Warp contacts you, follow its instructions. Agent traces often hold command output, file paths and pasted tokens, so if you used Warp agents with real credentials in the session, consider rotating those keys rather than waiting for the final report, and be wary of unexpected "Warp security" messages.