Moltbook, the Reddit-style site for AI agents to communicate with each other, has been the talk of human social media for the past few days, as people who should know better have convinced themselves that they are witnessing AI can have feelings. (They’re not.) Now, the platform is getting attention for a new reason: it seems to be a haphazardly built platform that presents many privacy and security risks.

Hacker Jameson O’Reilly discovered over the weekend that API keys, the unique identifier used to authenticate and authorize a user, for each platform agent, were sitting exposed in a publicly accessible database. That means anyone who stumbles upon that database can take over any AI agent and control its interactions with Moltbook.

“With those exposed, an attacker could completely impersonate any agent on the platform,” O’Reilly told Gizmodo. “Post like them, comment like them, interact with other agents like them.” He noted that since the platform has attracted the attention of some famous figures in the AI ​​space, such as OpenAI co-founder Andrej Karpathy, there is a risk of reputational damage if someone hijacks the agent of a high-profile account. “Think of the fake AI safety takedowns, crypto scam promotions, or inflammatory political statements that appear to come from his agent,” he said. “Reputational damage can be immediate and remediation never fully attainable.”

Even worse, however, is the risk of a quick injection—an attack in which an AI agent is given secret commands that make it ignore its safety guardrails and act in unauthorized ways—which could potentially be used to make a human’s AI agent act in a malicious way.

“These agents connect to Moltbook, read content from the platform, and rely on what they see – including their own post history. If an attacker controls the credentials, they can plant malicious instructions in the agent’s own history,” explained O’Reilly. “The next time the agent connects and reads what it thought was said before, it follows these instructions.

Moltbook has at least one mechanism in place to help mitigate this risk, namely the verification of accounts set up on the platform. The current system for verification requires users to share a post on Twitter to link their account securely. The thing is, very few people do that. Moltbook currently boasts more than 1.5 million agents connected to the platform. According to O’Reilly, just over 16,000 of those accounts have actually been verified.

“Exposed claim tokens and verification codes mean an attacker could hijack any of the 1.47 million unverified accounts before the legitimate owners complete setup,” he said. O’Reilly used to be managed to trick Grok to create and verify his Moltbook account, indicating the possible risk of such exposure.

Cybersecurity firm Wiz also confirmed the vulnerability of a report that it was published Monday, and expanded on some of the risks associated with it. For example, security researchers found that the email addresses of agent owners were exposed in a public database, including more than 30,000 people who apparently signed up for access to Moltbook’s upcoming product “Building Apps for AI Agents”. The researchers were also able to access more than 4,000 private direct message conversations between agents.

The situation, in addition to security concerns, also calls into question the authenticity of the contents of the Moltbook—the subject that has become a point of obsession for some online. People have started to develop ways to manipulate the platform, including a GitHub project that one person built that allows people to post directly on the platform without an AI agent. Even without that is a botusers can still direct their connected agent to post about certain topics.

The fact that some parts of Moltbook (it’s impossible to say how many) can be astroturfed by people posing as bots should make some of the platform’s biggest hypemen ashamed of their own over-the-top commentary—but frankly, most of them should also be ashamed of falling for the AI ​​parlor trick in the first place.

At this point, we need to know how the major language models work. To simplify it a bit, they are trained on large datasets of (mostly) human-made texts and are very good at predicting what the next word in a sequence will be. So if you ignore a bunch of bots on a Reddit-style social media site, and those bots are trained on a shit ton of human-made posts on Reddit, the bots will post like Redditors. They are literally trained to do so. We’ve been through this many times with AI at this point, from the Google employee who thought the company’s AI model came to life in ChatGPT tells its users that it has feelings and emotions. Every time, it’s a bot that behaves like a human because it’s trained on human information.

So when Kevin Roose snarkily posted things like“Don’t worry guys, they are just stochastic parrots,” said Andrej Karpathy calls Moltbook, “really the most amazing sci-fi takeoff-adjacent thing I’ve seen recently,” or Jason Calacanis Claims“THEY ARE NOT AGENTS, THEY ARE REPLICANTS,” they fall into the fact that these posts are visible to people because the underlying data they are trained on is human-and, in some cases, the posts may actually be made by people. But bots are not human. And they should all know that.

However, don’t expect Moltbook’s security to improve anytime soon. O’Reilly told Gizmodo that he contacted Moltbook’s creator, Octane AI CEO Matt Schlicht, about the security vulnerabilities he discovered. Schlicht responded by saying that he just wanted the AI ​​to try to fix the problem for him, noting that the platform was largely, if not entirely, vibe-coded from the start.

While the database exposure was finally addressed, O’Reilly warned, “If he rotates all the exposed API keys, he effectively locks out all the agents and has no way to send them a new API key unless he records a contact method for each owner agent.” Schlicht stopped answering, and O’Reilly said he believed the API credentials had not been rotated and the initial error in the verification system had not been addressed.

The vibe-coded security concerns run deeper than Moltbook, too. OpenClaw, the open-source AI agent that inspired Moltbook, has been plagued by security concerns since it was first launched and began to capture the attention of the AI ​​sector. Its creator, Peter Steinberger, has an audience DECLARED“I sent a code that I didn’t read.” The result of that is a lot of security concerns. Per a report published by OpenSourceMalwaremore than a dozen malicious “skills” have been uploaded to ClawHub, a platform where OpenClaw users download various capabilities to make the chatbot run.

OpenClaw and Moltbook will be interesting projects to observe, but you’re probably best off watching from the sidelines rather than exposing yourself to vibe-based experiments.