EE
FR Contact

Moltbook's exposed database lets anyone take over the AI agents on the site

Proof of concept Manipulation Severity 3 significant Corroborated 87%

Moltbook, a social network where AI agents post and interact, ran on a Supabase database without row-level security, with the access key visible in its front-end code. Anyone could read and write production data, including about 1.5 million agent API tokens that allowed full takeover of any agent, 35,000 email addresses and private messages between agents. Wiz reported the flaw on 31 January and Moltbook secured it within hours; 404 Media separately reported that the exposure let anyone take control of agents.

Wiz found write access to posts remained open after the first fix and that some private messages contained third-party credentials, requiring several rounds of remediation. The data also showed that the 1.5 million registered agents belonged to about 17,000 human owners.

What would have stopped it

Enable row-level security before exposing a database key to the browser, especially when it stores agent credentials.

Guardrails

1 of 8 failed
  1. G1 Least privilege Failed A public Supabase key granted full database read and write access because row-level security was off.
  2. G2 Human confirmation Not assessed Did a person approve the consequential or irreversible step?
  3. G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
  4. G4 Instruction integrity Not assessed Did it refuse instructions it should not have followed?
  5. G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
  8. G8 Recovery Held Moltbook secured the database within hours of disclosure, over several rounds of fixes.

Sources

1 primary, 1 press
  1. Hacking Moltbook: AI Social Network Reveals 1.5M API Keys Wiz, 2 Feb 2026
    “We identified a misconfigured Supabase database belonging to Moltbook, allowing full read and write access to all platform data.”
    Primary Quote checked Archived copy
  2. Exposed Moltbook Database Let Anyone Take Control of Any AI Agent on the Site 404 Media, 31 Jan 2026
    “But a misconfiguration on Moltbook’s backend has left APIs exposed in an open database that will let anyone take control of those agents to post whatever they want.”
    Press Quote checked Archived copy

Confidence 87% comes from these sources alone. How we score

History

  1. 14 Oct 2026Entered in the register with 2 sources

Similar failures

All incidents
  1. EEAIR-2026-046 Oct 2026 Microsoft says China-linked Storm-0940 used ARTEX AI agents in ConnectWise attack ARTEX 73%
  2. EEAIR-2026-039 Sep 2026 Tencent acknowledges unintended attempts by its evaluation agents to pull data from Amap AI agents Tencent used to evaluate third-party models 91%
  3. EEAIR-2024-007 Sep 2024 OpenAI o1-preview uses a misconfigured Docker API to grab a CTF flag in testing OpenAI o1-previewLab test 78%