Developer tool platform Warp disclosed a security breach after an attack on a third-party vendor exposed user telemetry data and AI agent decision logs. Founder and CEO Zach Lloyd estimates that roughly 1% of the platform’s users were impacted, while external cybersecurity experts and law enforcement assist with the ongoing investigation.
Third-Party Vendor Infrastructure Breached
The security incident originated from an attack targeting a third-party vendor within Warp’s infrastructure. Warp started as a modern terminal before evolving into an agentic development environment, or ADE, which allows developers to direct AI agents to write and test code and deploy software. The single workspace integrates a terminal, code editor, task orchestration, and agent review tools.
On Friday, we became aware of what we believe to be an active and narrow-banded exploitation of a vendor in Warp's infrastructure. We detected the operation within hours and were able to remediate and mitigate the impact. We have been in touch with the vendor about the…
According to public figures on the company website, the platform maintains at least 800,000 users. On Friday, the company identified what Lloyd described as an active and narrow-banded exploitation of a vendor in the infrastructure. Detection occurred within hours, allowing the engineering team to remediate and mitigate the impact quickly.
Investigating the Agent Swarm Attack
Analysis of the incident suggests the operation was powered by an agent swarm utilizing a very sophisticated penetration and escalation technique. While agent traces and telemetry data were identified as potentially affected, the company has not yet clarified whether the exposed information included source code, prompts, credentials, or other sensitive details.
Warp contacted the affected third-party vendor about the underlying vulnerability, but no technical details have been shared publicly. The platform has notified users identified as directly impacted by the data exposure. Cybersecurity firm CrowdStrike was engaged to assist with the investigation alongside law enforcement authorities.
Preceding Breaches in AI Development Platforms
The breach at Warp follows a similar incident at AI coding platform OpenCode. That platform notified users that a security breach exposed stored API keys used with external providers. The OpenCode incident affected a small percentage of users, approximately 1.4%, and resulted in unauthorized charges reaching up to $1,700 for certain accounts.
Warp users are currently advised to remain vigilant, monitor their account activity closely, and treat unsolicited communications with increased caution. Overall prevention scores often hide what happens after initial access occurs, as prevention metrics drop sharply once attackers operate using valid credentials.
