TORONTO, October 28, 2026 —

Agent decision logs and telemetry data belonging to users of Warp, the agentic development environment, were exposed in an attack on a third-party vendor in the project's infrastructure, the company disclosed this week. Founder and CEO Zach Lloyd estimated that roughly 1 percent of Warp users may have been impacted. The platform's website says it has at least 800,000 users. Warp said it detected the operation within hours and was able to remediate and mitigate the impact, engaged CrowdStrike to assist with the investigation, informed law enforcement, and notified users identified as impacted.

What was exposed matters as much as how many people were affected. Warp identified agent traces and telemetry as the potentially affected data, but did not clarify whether the exposed information included source code, prompts, credentials, or other sensitive details. That gap is the point. An agent trace is not a server log line. It is a record of what an autonomous agent was asked to do, what it decided, what tools it called, and what it produced. In a development environment, that record can reveal code, credentials, internal systems, and working methods. Treating it as routine telemetry understates what an attacker gains from it.

The incident follows a breach disclosed last week at AI coding platform OpenCode, in which stored API keys used with external providers were exposed for about 1.4 percent of users, leading to unauthorized charges of up to $1,700 for some. The two incidents are different in detail, but they point in the same direction. AI coding tools now hold the two things attackers want most: the keys that pay for model access, and the record of everything agents did with that access. Securing the prompt alone does not secure either one.

"Prompts get all the attention, because prompt injection is the attack everyone can picture," said Sarah Reid, Securetron spokesperson. "But an agent's trace is the evidence of what actually happened. If that record is collected by a vendor, stored without clear limits, or reachable through a third party, it becomes a target in its own right. Enterprises need to know what agent activity is recorded, where it is kept, how long it is retained, and who can reach it, before an incident forces those questions."

AI-FW, Securetron's AI firewall and governance gateway, sits between AI agents and the models they call, inspecting every prompt and response in real time. Its guardrails cover jailbreak and prompt-injection detection, PII masking, toxicity filtering, and data-exfiltration blocking on inbound and outbound traffic, while semantic intent analysis scores requests against natural-language policies. Identity controls authenticate agents with API keys, JWT, mTLS, or Kerberos, enforce roles with RBAC, and connect SSO with OIDC and SCIM provisioning. Model routing keeps provider keys server-side, injected on forward, so endpoint agents never need to hold them.

Just as important for this incident is what AI-FW does with the record. Every transaction lands in a metadata-only audit log, and raw prompt and response content is never persisted. Risk scores per user, agent, and IP trigger automatic blocking, and the gateway is fail-closed by design, so a scanner error or missing configuration blocks a request rather than forwarding it unfiltered. The gateway runs in the customer's own environment, on premises or in their cloud, so agent traffic never needs to leave their network.

"Governance cannot stop at the prompt," Reid added. "It has to cover the whole lifecycle: what the agent was allowed to do, what it actually did, and what record remains afterward. If the audit trail itself becomes the leak, the controls failed at the last step."

The Starter plan of AI-FW is free, with 10 billion tokens per rolling 30 days and no credit card required. It is proprietary free-to-use software, not open source. For more information, visit https://aifw.io.

About Securetron
Securetron builds enterprise security infrastructure: AI-FW, the self-hosted AI firewall and governance gateway between AI agents and LLM backends, and PKI Trust Manager with Boltron-AI for certificate lifecycle automation. For more information, visit https://aifw.io and https://securetron.net.

Press contact:
Sarah Reid
Securetron
1 Yonge St, Toronto, ON M5E 1E6, Canada
+1 (438) 927-8036
[email protected]

###