{
  "id": "warp-vendor-breach",
  "url": "https://ohshit.app/incidents/warp-vendor-breach/",
  "title": "Warp reports vendor intrusion reaching agent traces and telemetry",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-10-26",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Warp",
    "third party",
    "data exposure"
  ],
  "ecosystems": [],
  "summary": "Warp estimates roughly 1% of users as a potential upper bound after an intrusion reached agent traces and telemetry. The vendor, vulnerability and exact exposed fields remain undisclosed; credential theft is not established.",
  "splash": "Warp users whose agent traces or telemetry were affected; exact accounts and attack prerequisites remain undisclosed",
  "wipe": "Follow verified Warp notices, preserve and review relevant activity, and apply exposure-specific credential guidance",
  "in_the_wild": "n/a",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Check for a verified Warp notification",
      "hint": "Warp says identified affected users were notified and will receive tailored instructions; contact Warp through known channels."
    },
    {
      "title": "Review relevant activity and any identified exposed secrets",
      "hint": "General response guidance: preserve audit evidence; revoke and rotate a credential if the investigation establishes exposure."
    }
  ],
  "sources": [
    {
      "name": "Warp CEO disclosure",
      "url": "https://x.com/zachlloydtweets/status/2114800787716972873",
      "says": "Original October 26 statement; X returned 403 during this review, so the reproduced text below was used.",
      "primary": false
    },
    {
      "name": "Reproduced copy of the CEO disclosure",
      "url": "https://ainews.leverageai.com.au/case/warp-vendor-infrastructure-exploitation",
      "says": "Reproduces the statement: roughly 1% upper bound, traces/telemetry, mitigation and CrowdStrike investigation.",
      "primary": true
    },
    {
      "name": "BleepingComputer",
      "url": "https://www.bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data/",
      "says": "Corroborates the disclosure; source code, prompts and credential exposure remain unspecified.",
      "primary": false
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "A vendor intrusion; the underlying flaw has not been identified.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 23, 2026",
      "title": "Warp says it detected the intrusion"
    },
    {
      "date": "Oct 26, 2026",
      "title": "CEO discloses preliminary scope and ongoing investigation"
    }
  ],
  "body_markdown": "The CEO describes mitigation within hours and an investigation with CrowdStrike and law enforcement. The roughly 1% figure is an estimate, not a confirmed victim count. An AI-agent swarm is a preliminary attribution. L3 reflects exposure at a developer tool without verified credential theft or broader compromise. The original post was blocked; the sources include both its URL and the reproduced statement actually read."
}