Warp data breach: what the vendor attack exposed, and what Warp's cloud keeps

The Morse teamPublished October 28, 202610 min read

The Warp data breach became public on October 26, 2026, when Warp's CEO, Zach Lloyd, posted that an attack on "a vendor in Warp's infrastructure" had reached "a limited amount of agent trace and telemetry data" from at most "roughly 1% of Warp users" (Zach Lloyd on X). Warp says it caught the attack within hours, has told the users it identified, is investigating with CrowdStrike, and has contacted law enforcement. As of October 28, Warp hasn't named the vendor or said whether the exposed traces contained code, commands, or secrets.

On October 28, 2026, we read Lloyd's post, which is Warp's only public statement on the incident so far, along with Warp's status page, privacy notice, security page, and the docs covering its telemetry, agent conversations, cloud agents, and Warp Drive. Warp's account of the incident is quoted from Lloyd. Where a detail appears only in press reports, we say so. Warp deserves credit for how much it publishes about its own data handling: a full list of the telemetry events it collects, a network log that shows every request the app sends, and its client source code under AGPL v3 (Warp). Those pages are how we know what its cloud keeps.

What happened in the Warp data breach?

Someone exploited a vendor that Warp's systems rely on, and got from there to Warp data. Lloyd's post begins: "On Friday, we became aware of what we believe to be an active and narrow-banded exploitation of a vendor in Warp's infrastructure. We detected the operation within hours and were able to remediate and mitigate the impact." That Friday was October 23.

He describes the method this way: "The attack appears to have come from an agent swarm using a very sophisticated penetration and escalation technique, likely starting with a hole in a vendor dependency." BleepingComputer's report credits the agent swarm to "analysis of the incident" (BleepingComputer). The words are Lloyd's own, and he hedges them twice, with "appears" and "likely." Treat the swarm as Warp's early read until the investigation reports.

Lloyd says Warp has "been in touch with the vendor about the vulnerability," is working with CrowdStrike "to do a more extensive and comprehensive investigation," and has "engaged law enforcement." He also apologized: "I'm very sorry that this incident has occurred." OpenAI's November 2025 breach also went through a vendor, its analytics provider, which we cover in ChatGPT data breach history.

What data was exposed in the Warp breach?

"Agent trace and telemetry data," in Lloyd's words, and Warp hasn't said more. His post doesn't mention source code, prompts, API keys, passwords, or payment details, either as exposed or as safe.

Warp's own docs explain what an agent's record can hold. For cloud agent runs, Warp says session transcripts include "agent-generated summaries of code context, file contents the agent reads, and command output" (Warp). Command output is where credentials tend to surface: a printed environment, a failed deploy that echoes a connection string, a debug log with a bearer token in it. Warp hasn't said whether the exposed traces came from conversations in the Warp app, from cloud agent runs, or from both.

Telemetry at Warp can hold more than counts of which buttons you pressed. Warp's privacy docs say that unless you've opted out of "Help improve Warp," it may collect "AI interactions and console inputs that power our AI features," on top of product usage events (Warp). Warp applies built-in redaction patterns to telemetry, but the Secret Redaction setting that lets you add your own patterns is "disabled by default." Business and Enterprise plans are exempt. For them, Warp says, "No AI interaction or console data is ever collected."

Warp's security overview adds how long it keeps telemetry: "When collected, Warp retains telemetry data indefinitely for analytics and debugging" (Warp). The same page says data collection is "enabled by default" for paid teams and "disabled by default" on Business and Enterprise. So Warp's pages describe those two plans two ways: the privacy docs say AI interaction data is never collected, and the security overview says collection is off by default, with team admins setting it.

How many Warp users were affected?

Up to about 1%, which Lloyd calls "an upper bound," and Warp hasn't given a number. Warp's home page says it is "trusted by over 800,000 developers" (Warp), a figure BleepingComputer cited. One percent of that is about 8,000 people. In March 2026, Warp's newsroom said it had passed "one million active developers" (Warp), and 1% of that would be nearer 10,000. Neither figure comes from Warp's statement on the breach.

Lloyd says Warp has "notified anyone who we have positively identified as impacted," and that anyone affected "will receive instructions from us on action they need to take." If no notice has reached you, Warp hasn't identified you so far, but the investigation is still running.

The Warp breach, date by date

What does Warp keep on its servers?

Lloyd's post names two kinds of data, but Warp's cloud holds more than that. We built this table from Warp's own pages on October 28, 2026. Warp hasn't said that anything beyond agent traces and telemetry was reached.

Some of Warp's own lines pull in different directions. The agents overview says "No customer AI data is retained, stored, or used for training" (Warp), but in context that covers Warp's model providers. The agents FAQ says "Warp reserves the right to use data collected to train models and improve Warp" (Warp). And Warp's security page says zero data retention "is available on Warp's Enterprise plan" (Warp), while the docs say it applies "across all Warp plans." For an individual, Warp's pricing FAQ says you get "full ZDR" by turning off Help improve Warp (Warp). We explain what the term does and doesn't promise in what is zero data retention.

What should Warp users do now?

Start with Warp's instructions if it contacted you. Then, whether or not it did:

1. Rotate any secret an agent saw. That means keys, tokens, passwords, and connection strings you pasted into a prompt, and any a command printed while the agent was running. Warp hasn't said secrets were exposed, but a trace can hold command output. Start with cloud credentials, CI tokens, and database passwords.
2. Turn off telemetry and crash reports. Open Settings, then Privacy (or search "privacy" in the Command Palette), and switch off Help improve Warp and Send crash reports. Warp says that with telemetry off, "no console interactions are ever persisted on Warp's servers" (Warp).
3. Decide where conversations live. In the same Privacy screen, Store AI conversations in the cloud controls syncing. Warp warns that with it off, "conversation data is lost when you log out" (Warp), so save anything you need first.
4. Turn on Secret Redaction. It's under Settings, then Privacy, then Secret redaction, and Warp publishes a list of recommended patterns to add (Warp). The patterns are case-sensitive unless you start them with (?i).
5. Treat breach emails with care. BleepingComputer's report tells Warp users to watch their account activity and be wary of unsolicited messages. A breach notice makes good bait, so reach Warp's instructions through the app or warp.dev rather than a link in a message you didn't expect.

If an agent read files from someone else's systems, such as a client's or an employer's, tell whoever owns them too. An agent can also be steered by text it reads, which we cover in what is prompt injection.

How Morse keeps chat logs out of a breach

The attack could reach agent traces and telemetry because copies of them were kept on servers, Warp's or a vendor's, that an attacker got into. Warp hasn't said which. Each company and vendor that keeps a log of what you typed is one more place an attacker can find it. Morse's servers don't keep messages or log message content, so a breach of our infrastructure has no chat log to find.

Morse is a chat app, not a terminal or a coding agent. When you want a model's help with code and would rather leave no transcript on a server, the Free plan includes coding, file, and other chat tools. Here is how the four things Warp keeps compare:

• Agent traces with command output. A Morse chat's transcript is kept in your browser, encrypted, and nowhere on our servers. A file you attach is sent with the message and never stored by Morse.
• Telemetry kept "indefinitely." Your Morse account holds your sign-in details, plan, balance, and a usage ledger with no content. Morse doesn't train AI on what you write, sell your data, or show ads, so there's no "Help improve" switch to remember to turn off.
• Shared sessions left on a server for a week. Since our servers keep no messages, no copy of a chat sits there waiting to expire. A temporary chat goes further and is kept only in memory, not even in your browser's history.
• Warp Drive variables synced to the cloud. Morse keeps your settings, personas, and the characters you make in the browser with your chats, encrypted. Unlocking that data needs two keys, one that stays on your device and one our server hands over when you sign in, so someone holding a copy of the browser's data can't read it alone. Our privacy policy says this storage encryption "is not end-to-end encryption against us: we hold the key, but we never receive the data it unlocks."

Each chat also gets a privacy mode, which decides who handles a message between you and the model:

• Private, for the error output you'd otherwise hand a Warp agent. Private is where a new chat starts. The hosts running DeepSeek, Kimi, GLM, and other open-weight models, plus Grok, have agreed to keep nothing: Morse has zero data retention agreements with its inference, search, and other providers. When a provider confirms zero retention on each reply, Morse checks for it and refuses a reply without it.
• E2EE, for the config file you'd never want in an agent trace. Before anything is sent, your browser verifies the secure enclave's hardware attestation and encrypts the message for that enclave alone; our servers forward only ciphertext, which they have no way to read. Third-party providers run the enclaves, not Morse, and the protection depends on the enclave hardware and attestation working as designed. E2EE chats come with Pro, $19 a month.
• Anonymous, to ask GPT, Claude, or Gemini about a Warp error without your account on it. Our proxy takes off your account, email, and IP address, then passes the message on under Morse's own account. The provider sees the message without knowing it's you. It may keep the message for a limited time to check for abuse, under its own policy, so cut keys and internal hostnames from the paste.

Whatever app you use, paste the error and leave the key out. Your Morse history lives only in your browser, so clearing it or losing the device erases your chats, and Morse has no way to restore them. Save a copy of anything you'll need. The details are in our privacy policy.

Open a chat from the Morse home page without an account, or start free on a plan that asks for no card.