Warp Breach Exposes AI Agent Logs and User Telemetry

A terminal sees everything a developer types. An AI agent running inside that terminal sees more: the files it opens, the commands it proposes, the errors it reads back. Warp, the AI terminal used by hundreds of thousands of developers, now says some of that record leaked.

CEO Zach Lloyd disclosed the incident in a post on X, and BleepingComputer reported on October 27, 2026 that agent decision logs and user telemetry were exposed after an attack on a third party vendor. The open question is what those logs contained.

Key Takeaways

• Warp CEO Zach Lloyd says "roughly 1% of Warp users may have been impacted" by an attack that exposed AI agent decision logs and telemetry data.
• The entry point was "an active and narrow-banded exploitation of a vendor in Warp's infrastructure," and neither the vendor nor the vulnerability has been named.
• Warp has notified affected users, engaged CrowdStrike, and informed law enforcement, but it has not said whether the logs held source code, prompts, or credentials.
• Warp has not announced any credential rotation, so developers who pasted tokens or API keys into Warp agent sessions should rotate them themselves.

What Did Warp Disclose?

Warp disclosed that agent decision logs and telemetry belonging to a small share of its users were exposed through a compromised vendor. According to Lloyd's statement on X, the company became aware of the activity on a Friday, detected the operation "within hours," and moved to remediate it.

The confirmed facts are thin:

• Data types: AI agent decision logs and telemetry.
• Scope: "roughly 1% of Warp users," per Lloyd.
• Response: affected users notified, CrowdStrike brought in, law enforcement informed, the vendor contacted about the flaw.

Warp's website puts its user base at more than 800,000. One percent of that is about 8,000 developers. That figure is our arithmetic, not Warp's, and the real count could differ if the 800,000 number is out of date.

How Did the Attackers Get In?

Nobody outside Warp knows yet; the company has only said a vendor in its infrastructure was exploited. It has not named the vendor, the vulnerability, or which system the logs were sitting in.

BleepingComputer's report cites analysis describing the attack as powered by "an agent swarm" using "a very sophisticated penetration and escalation technique." That analysis is not attributed to a named researcher, so treat it as a claim rather than a finding. If it holds up, it would be an AI driven intrusion stealing the output of AI coding agents, which is a neat and unsettling loop.

The vendor angle fits a pattern this year. The Vercel breach traced to Context AI and the Mercor incident tied to LiteLLM both started with a supplier, not the company that ended up in the headline.

What Can AI Agent Logs Contain?

An agent decision log can contain anything the agent read, ran, or reasoned about, which in a terminal often includes secrets. Warp has not said what its exposed logs held, so the list below describes what is possible, not what is confirmed:

• Commands the agent proposed or executed, including ones with inline tokens like curl -H "Authorization: Bearer ...".
• Output the agent read back: env dumps, .env files, cloud CLI responses, stack traces with connection strings.
• File paths, repository names, hostnames, and internal service names that map out your infrastructure.
• Your prompts, which often describe unreleased features or customer problems in plain English.

Warp does ship a redaction feature. Its privacy documentation states that "Configurable Secret Redaction is disabled by default and masks content that matches your patterns before AI requests are sent." The docs also say telemetry payloads get separate built in redaction. Pattern matching catches well formed keys; it misses a password typed into a prompt or a token with an unusual prefix.

Why Telemetry Is Now a Sensitive Data Store

Most coverage frames this as a telemetry leak, which sounds harmless. The more useful reading is that AI agent transcripts are a new class of sensitive data that vendors still store and route like analytics.

Classic product telemetry is button clicks and crash counts. Agent transcripts are closer to a shell history with commentary. Warp's own docs say it collects "AI interactions and console inputs that power our AI features," and that analytics flow through third party processors. Every processor in that chain is another place the transcript lives, and another vendor whose bug becomes your incident.

The docs also say "Telemetry must be enabled to use AI features on the Free plan," while paid plans can opt out. Business and Enterprise plans are covered by a Zero Data Retention agreement. In practice, the users least able to pay for privacy are the ones whose agent data is most likely to be retained.

Warp is not alone. BleepingComputer notes a separate incident at OpenCode, another AI coding tool, where stored API keys were exposed for about 1.4% of users, some of whom saw unauthorized charges of up to $1,700. Two AI developer tools, two breaches touching roughly 1% of users each, in the same news cycle. We covered the local version of this risk when Apple tightened Full Disk Access for AI agents; the Warp case shows the same data is exposed once it leaves the laptop.

What Developers Should Do Now

Rotate anything that may have passed through a Warp agent session, whether or not you received a notice. Warp has not announced any credential rotation on its side, so this falls on you.

Rotate

• Cloud keys (AWS, GCP, Azure) and any LLM provider API keys you exported or pasted while an agent was active.
• GitHub and GitLab personal access tokens, npm and PyPI publish tokens, and database passwords that appeared in agent output.
• Session cookies or OAuth tokens visible in any curl command the agent ran.

Leaked developer credentials get abused fast. Our write up on 543,000 GitHub credentials exposed in public data shows how long they stay live after the fact.

Audit telemetry

• In Warp, open Settings > Privacy and review the "Help improve Warp" and "Send crash reports" toggles. Per Warp's docs, with telemetry disabled no console interactions are persisted on its servers.
• Turn on Secret Redaction and add patterns for your organization's internal token formats.
• Use Warp's Network Log to see what actually leaves your machine.
• Admins can enforce telemetry settings across a team instead of trusting each developer to flip the switch.

Detect

• Check cloud audit logs (CloudTrail, GCP Audit Logs) for key usage from unfamiliar IPs since mid October.
• Watch LLM provider billing dashboards for spikes, the abuse pattern seen at OpenCode.

What This Means for Your Inbox

Warp has not said email addresses were exposed, and the reporting does not claim they were. The inbox risk here is indirect but real.

First, breach notices invite imitations. Affected users are getting genuine emails from Warp right now, and attackers know it. A fake "Warp security notice" asking you to re-authenticate or download a patched build is an obvious next move, a tactic we have seen around fake VS Code and GitHub alerts aimed at developers. Go to Warp's site directly instead of clicking.

Second, terminals touch email more than people think. Git commit configs carry your email address, and agents frequently handle Gmail API or SMTP credentials when debugging mailers. If you ever let an agent work on email sending code, add those app passwords and OAuth client secrets to your rotation list.

Looking Ahead

The details that matter most are still missing: the vendor's name, the vulnerability, and whether secrets were in the exposed logs. Watch Warp's documentation and Lloyd's account for a fuller postmortem once the CrowdStrike investigation wraps.

Until then, treat every AI agent transcript as if it were your shell history plus your password manager's clipboard. Keep secrets out of prompts, keep telemetry off where you can, and rotate on suspicion rather than on confirmation.

Days later, the Northflank breach showed what happens next: stolen AI API keys being spent on customers' bills.