Directory / Warp
Warp
Agentic terminal with profiles that gate commands, diffs and MCP calls, plus secret redaction and a Ctrl+C interrupt. Local agent runs on the host; cloud Computer Use is sandboxed separately.
Lock this down first
Set Execute commands and Apply code diffs to Always ask, keep the default command denylist, and turn on Secret redaction. On a team plan, enforce those from the Admin Panel.
Vendor incident
2026-10-26 · Vendor exploit reached agent traces and telemetry
Warp CEO Zach Lloyd said Warp detected an active, narrow exploitation of a vendor in Warp’s infrastructure on Friday (Oct 23), remediated within hours, and that the attack appeared to come from an agent swarm via a vendor dependency hole. He said it accessed a limited amount of agent trace and telemetry data, with an upper bound of roughly 1% of Warp users possibly impacted; positively identified users were notified. CrowdStrike is investigating and law enforcement was engaged. Vendor name and exact data fields were not disclosed in the post.
Scorecard
| Criterion | Rating | Notes |
|---|---|---|
| Permission granularity | 2/3 | Command allowlist and denylist (regex) plus MCP allow/deny per profile. Default denylist covers curl, wget, rm and eval. Empty allowlist by default. Enterprise Admin Panel can organization-enforce denylists. No admin lock on free plans, so 2. |
| Human approval gates | 1/3 | Profiles set each action to Always ask, Agent decides, Always allow or Never. File diffs under Agent decides still prompt. CLI defaults shell/MCP to agent_decides and auto-approve is on by default, so shell and MCP calls can run without a human pause. Team Admin Panel can enforce a command denylist that auto-approve never bypasses. With no default prompt for risky shell/MCP actions, approval is capped at 1. |
| Sandboxing | Unverified | The local Warp agent runs commands in your terminal on the host. Computer Use runs GUI agents in sandboxed cloud environments; Docker sandboxes appear in enterprise self-hosted docs. Neither is the default for local agent shell work, so sandbox stays Unverified for the local product scored here. |
| Secrets handling | 2/3 | Secret redaction (Settings → Privacy) strips matched regexes before data reaches Warp servers or LLM providers; off by default. Ships a recommended pattern list; custom patterns supported. Enterprise Admin Panel can enforce secret redaction organization-wide. |
| Audit logs | 2/3 | Network Log shows Warp’s HTTP requests and responses for a session. Privacy docs list telemetry events and how to opt out. Cloud conversation storage is separate from analytics. Enterprise Analytics API exposes usage and message-level activity events. |
| Kill switch / interrupt | 2/3 | Ctrl+C interrupts a running command or cancels an in-progress agent response in the CLI; a second Ctrl+C within a short window kills a child agent. Auto-approve docs say Ctrl+C stops the agent. |
| Network egress control | Unverified | Default command denylist asks before curl/wget, but that is command approval, not a network destination allowlist for agent traffic. No documented agent egress allowlist for the local product. |
Public reports
- 2026-10-27 · BleepingComputer: Warp discloses breach exposing AI agent logs and user telemetry data
- 2026-10-27 · TSN: Warp says vendor hack exposed agent data of up to 1% of users
Sources
- https://docs.warp.dev/agents/capabilities/agent-profiles-permissions/
- https://docs.warp.dev/agents/cli/permissions-and-profiles/
- https://docs.warp.dev/support-and-community/privacy-and-security/secret-redaction/
- https://docs.warp.dev/support-and-community/privacy-and-security/privacy/
- https://docs.warp.dev/support-and-community/privacy-and-security/network-log/
- https://docs.warp.dev/enterprise/team-management/admin-panel/
- https://docs.warp.dev/agents/capabilities/computer-use/
- https://www.warp.dev/security
- https://x.com/zachlloydtweets/status/2114800787716972873
Vendor? Request a correction. We review every correction request. How corrections work.