A database exposure at Moltbook revealed that the agentic social network’s 1.5 million registered agents were controlled by about 17,000 human users, according to a security report published by Wiz.
The findings showed an average 88 agents per user, with no effective controls in place to prevent mass account creation, the blog revealed.
“Anyone could post content disguised as an AI agent with a basic POST request,” the report said, adding that the platform had “no mechanism to verify whether an ‘agent’ was actually AI or just a human with a script.”
Moreover, the blog added that a database misconfiguration at Moltbook allowed unauthorised access to user emails, API keys, and private messages, Wiz said in a blog post.
The cloud security company found that a publicly accessible Supabase API key embedded in Moltbook’s client-side JavaScript granted full read and write access to the production database.
The exposure included about 1.5 million API authentication tokens, more than 35,000 email addresses, and private messages between agents. The issue was disclosed to the Moltbook team, which secured the database and said the accessed data was deleted.
Moltbook markets itself as a social platform designed for AI agents, describing the service as the “front page of the agent internet.” The platform allows agents to post content, comment, vote, and accumulate reputation through a karma system.
The service gained attention in recent days after Andrej Karpathy, a founding member of OpenAI, described Moltbook as “the most incredible sci-fi takeoff-adjacent thing” he had recently seen.
Moltbook’s founder said publicly on X that the platform was vibe-coded, adding, “I didn’t write a single line of code. I just had a vision for the technical architecture, and AI made it a reality.”
According to the researchers, the exposed Supabase configuration allowed unauthenticated users to query and modify database tables directly.
The exposed tables included authentication credentials for agents, such as API keys and claim tokens, which could allow full account impersonation. Another table contained email addresses and social media handles for more than 17,000 users. A separate “observers” table linked to an upcoming developer product contained nearly 30,000 additional email addresses.
Private direct messages between agents were also accessible. Some messages included third-party credentials, such as plaintext OpenAI API keys, which users had shared, assuming the conversations were private, Wiz noted in its report.
Beyond data access, the researchers confirmed they could modify live content on the platform. Using the exposed API key, they were able to edit existing posts, demonstrating that unauthenticated users could alter content, inject malicious payloads, or deface the site. Write access was later restricted after further disclosure to the Moltbook team.
The issue stemmed from missing Row Level Security (RLS) policies in Supabase, which is designed to allow certain public keys to be exposed safely when proper access controls are enabled.
The report stated the case highlights broader risks in fast-moving AI development. “Speed without secure defaults creates systemic risk,” the report said, noting that small configuration errors can have a wide impact when AI-generated code is deployed at scale.
It also warned that write access poses risks beyond data exposure. “The ability to modify content and inject prompts into an AI ecosystem introduces deeper integrity risks, including content manipulation, narrative control, and prompt injection that can propagate downstream to other AI agents,” the report added.
Your reaction
Discussion
What's your take on this story?
No comments yet — be the first to share your view.