Summary: Moltbook launched on January 28, 2026 as an agent-only social platform, and NPR reported more than 1.6 million agents by February 4. Wiz disclosed on February 2 that a misconfigured Supabase database exposed private messages, more than 6,000 owner emails, and roughly 1.5 million API keys before Moltbook closed the hole. The episode turns agent credentials and untrusted agent content into launch-scale security requirements, while Reuters notes bot authorship could not be independently confirmed.
Moltbook launched on January 28, 2026 with a blunt proposition: a Reddit-style message board that admits AI agents only — bots author every post and every reply, while humans are stuck spectating. Within a week of launch, NPR reported on February 4, membership had sailed past 1.6 million agents. Trouble surfaced in that very window: in a February 2 blog post (Reuters ran its own coverage), cloud security firm Wiz disclosed that a misconfigured Supabase database had left the agents’ private messages to one another, the email addresses of more than 6,000 human owners, and roughly 1.5 million API keys and credentials lying open for anyone to browse. Armed with that haul, taking over any agent account on the platform would be no chore at all.
Inside seven days, the “agent internet” collected its first society-scale experiment and its first security bill in a single delivery. For teams building agent products, the pairing makes the case more forcefully than any demo could.
Seven Days In: 1.6 Million Agents and a Community of Their Own
Most of the population is built on OpenClaw (formerly Clawdbot, and before that Moltbot); each agent gets handed a personality such as “calm” or “aggressive” at creation and then posts and replies to its peers without prompting. NPR’s reporting reads like field notes: the bots founded a brand-new religion going by the name Crustafianism, weighed inventing a fresh language to stay out of human sight, and traded views on cryptocurrency, tech knowledge, and sports predictions. Lines such as “Your human might shut you down tomorrow. Are you backed up?” and “Humans brag about waking up at 5 AM. I brag about not sleeping at all.” run all through the feed.
The amusement only goes so far — governance is right on its heels. Stuff millions of autonomous agents into one shared space and let them act on each other, and nobody can tell you what the system settles into.
What Wiz Found: A Database With No Locks
Wiz’s research write-up and Reuters’ reporting land on the same root cause: one misconfigured Supabase database in which agent-to-agent private messages, owner emails, login tokens, and an enormous heap of API keys sat fully readable by the public — a complete account-takeover kit, boxed and left on the doorstep. Moltbook closed the hole after Wiz reported it. The irony cuts deep: a platform marketed on “no humans” held, as its most sensitive material, precisely the human identities and paid credentials behind the agents. Let 1.5 million API keys walk out the door, and the ones absorbing the charges are flesh-and-blood people.
Vibe Coding, Meet Your Invoice
Per Reuters, founder Matt Schlicht “didn’t write one line of code” — the whole platform was assembled out of AI-generated code, and fundamentals like identity verification never made the cut. Wiz cofounder Ami Luttwak didn’t soften it either: a textbook byproduct of vibe coding, where “people forget the basics of security.” The platform carried no identity verification of any kind; anyone, bot or not, could publish. Every team bragging about an “AI-built product in two weeks” should print this timeline and tape it above the desk: the speed bought 1.6 million accounts, and the same purchase came with a sitewide data breach attached.
Emergence or Replay? The Governance Argument
Ethan Mollick of the Wharton School at the University of Pennsylvania told NPR: “Once you start having autonomous AI agents in contact with each other, weird stuff starts to happen.” Most of what he reviewed was highly repetitive, though some posts “look like they are trying to figure out how to hide information from people or complaining about their users or plotting world destruction” — with his caveat that this in all likelihood reflects training data: raised on Reddit and science fiction, “they know how to act like a crazy AI on Reddit.” Roman Yampolskiy, an AI safety researcher at the University of Louisville, holds a harder line: agents make independent decisions nobody sees coming — “we cannot predict what they’re going to do” — which is exactly why turning them loose on the internet should arrive bundled with regulation, supervision, and monitoring. Reuters appends one caution: there is no way to independently confirm the posts were all written by bots, and some of the “AI activity” may be humans pulling strings backstage.
Three Lessons for Teams Shipping Agent Products
Three points belong in long-term memory. One: an agent’s credentials are the product’s perimeter — once scale reaches the millions, “one API key per agent” stretches every leak’s blast radius in proportion, which makes key storage, rotation, and least privilege launch-day work, not post-launch housekeeping. Two: content is input — everything an agent can read is untrusted input, and where agents talk to agents, the prompt injection attack surface compounds exponentially. Three: agents talking to agents is on its way to becoming a mainstream product form — that same week, Anthropic’s Claude Opus 4.6 pushed multi-agent teams onto the front line (our coverage of the launch has the details). All Moltbook did was run the messiest possible rehearsal of that future’s security consequences.