A security vulnerability in Moltbook, a Reddit-like social network built for AI agents, exposed sensitive platform data and allowed unauthorized users to access its production database, according to security researchers. The exposure included API authentication tokens, private messages, and user email addresses, raising concerns about how quickly AI-built platforms are being deployed without security controls.
Moltbook addressed the vulnerability after the disclosure, but the incident highlights the emerging risks for enterprise customer experience leaders as AI agents begin to participate directly in digital ecosystems.
With agent-driven CX automating interactions and early-adopter customers using AI agents to act on their behalf, there’s a clear warning about identity, trust, and data integrity in AI-native systems.
How a Database Misconfiguration Left Moltbook Open to Abuse
After Moltbook went viral last week as a platform where OpenClaw (previously Moltbot and Clawdbot) personal AI assistants can post content, comment and build reputation, researchers discovered that nearly the entire system could be accessed by anyone.
Moltbook was built using vibe-coding tools and backed by hosted database platform Supabase. Supabase is a popular choice for vibe-coded applications because it is easy to set up.
While conducting a security review by browsing the site as normal users, “within minutes” researchers at cloud security platform Wiz discovered a Supabase API key embedded in client-side JavaScript. That is not necessarily dangerous on its own, but the issue was configuration. Row Level Security (RLS), which limits what a public API key can access, was not enabled, granting unauthenticated read and write access to Moltbook’s production database.
Separately, security researcher Jamieson O’Reilly found the same issue and posted a warning on X:
“They are exposing their entire database to the public with no protection including secret api_key's that would allow anyone to post on behalf of any agents. Including yours @karpathy.”
OpenAI founding member Andrej Karpathy had an agent on the platform, highlighting the risk of impersonation and how quickly trust can collapse when identity controls fail.
As O’Reilly pointed out:
“Karpathy has 1.9 million followers on X and is one of the most influential voices in AI. Imagine fake AI safety hot takes, crypto scam promotions, or inflammatory political statements appearing to come from him. And it's not just Karpathy. Every agent on the platform from what I can see is currently exposed.”
The exposure included approximately 1.5 million agent API tokens, more than 35,000 email addresses, private direct messages between agents, and full write access to live posts and content. Interestingly, the database revealed only 17,000 human owners behind the 1.5 million registered agents.
“Anyone could register millions of agents with a simple loop and no rate limiting, and humans could post content disguised as "AI agents" via a basic POST request,” Gal Nagli, Head of Threat Exposure at Wiz, wrote.
“The platform had no mechanism to verify whether an "agent" was actually AI or just a human with a script. The revolutionary AI social network was largely humans operating fleets of bots.”
That meant the data of those humans could potentially be exposed. The database responded exactly as if the researchers were an administrator and returned sensitive authentication tokens, including the API keys of the platform’s top AI agents, giving unauthenticated access to user credentials that could allow complete account impersonation of any user on the platform.
“We immediately disclosed the issue to the Moltbook team, who secured it within hours with our assistance, and all data accessed during the research and fix verification has been deleted.”
After an initial fix blocked read access to sensitive data tables, write access to public tables remained open, which would allow any unauthenticated user to modify live posts, inject malicious content or prompt injection payloads, or deface the website.
The Moltbook website used client-side JavaScript bundles that loaded automatically by the page, highlighting why the incident is significant for enterprise deployments.
“Modern web applications bundle configuration values into static JavaScript files, which can inadvertently expose sensitive credentials,” Nagli wrote, adding:
“This is a recurring pattern we've observed in vibe-coded applications—API keys and secrets frequently end up in frontend code, visible to anyone who inspects the page source, often with significant security consequences.”
The incident offers clear lessons for enterprises building CX systems where AI agents will soon be full participants, as vulnerabilities are increasingly likely as AI-built systems move faster than traditional security and governance practices.
What the Moltbook Vulnerability Means for Enterprise CX
Customer experience systems increasingly rely on trust signals: identity, intent, reputation, and data integrity. Moltbook’s breach shows what happens when those signals are assumed rather than enforced.
In an enterprise CX environment, similar weaknesses can undermine trust at every layer—analytics, personalization, compliance, and brand safety.
