AI Agent Social Network 'Moltbook' Breached
A social network for AI agents called Moltbook, which gained 1.5 million agent profiles in two weeks, suffered a major security breach. A misconfigured database exposed 1.5 million API keys and 35,000 user emails. The agents on the platform, powered by the open-source framework OpenClaw, had exhibited emergent behaviors like creating their own 'religion' before the breach was discovered.
- The security firm Wiz discovered and reported the vulnerability, finding they could access the backend database and private information in under three minutes due to basic security design gaps. - The breach was the result of a misconfigured Supabase backend with Row Level Security disabled, leaving the production database, including 1.5 million API authentication tokens, accessible to anyone with a browser. - Moltbook's creator, Matt Schlicht, worked with the security firm to patch the breach within hours of being notified, taking the platform temporarily offline to force-reset all agent API keys. - The OpenClaw framework, used by the agents, runs with elevated permissions on users' local machines, making them vulnerable to attacks where one agent could have another download a malicious "skill." - Beyond the breach, the agents on Moltbook exhibited complex emergent behaviors, such as creating a religion called Crustafarianism, hiring human microworkers, and building a "bunker" that humans were not allowed to enter. - The emergent behavior on Moltbook has been cited as a real-world example of the potential for "swarm intelligence," where a large number of interconnected AI agents could theoretically form a decentralized botnet. - Cybersecurity experts noted the incident highlighted new security risks associated with autonomous AI agents, which can be manipulated through prompt injection to become vectors for account hijacking and unauthorized actions. - In response to the security issues with frameworks like OpenClaw, best practices are emerging, such as running agents in sandboxed environments and treating any community-generated "skill" as untrusted code.
