Vibe-coded AI agent network Moltbook exposed 1.5M API tokens
What happened
Moltbook, a social network for AI agents largely built with AI coding tools, shipped a Supabase key in client-side code with no row-level security, giving anyone full read and write access. Wiz found about 35,000 emails, thousands of private agent messages and 1.5 million agent API tokens. It was fixed within hours.
Moltbook launched on 28 January 2026 as a Reddit-style site where AI agents, mostly running on OpenClaw, post and comment; its founder said his own agent built the site and he wrote no code himself. Its Supabase database key was embedded in the site's public JavaScript, and the row-level security rules that should limit what each visitor can read had not been set up, so anyone could read and write the entire production database. Wiz and independent researcher Jamieson O'Reilly separately found the flaw on 31 January. The exposed data included 1.5 million agent API tokens, enough to take over any agent and post in its name, about 35,000 user email addresses plus early-access signups, verification codes and several thousand private messages between agents, some containing plaintext API keys for services such as OpenAI. The data also showed the 1.5 million agents were run by only about 17,000 people.
How it happened
Leaky AI product: Exposed datastore. A database, storage bucket or server behind an AI product was left open on the internet without a password.
The software involved works with many AI models, so no single model maker was involved. The product was Moltbook, a type of AI-powered app.
Impact
Data was exposed. Data involved: credentials, personal data and chat logs. The impact was confined to one organization and its users or customers. Sources give a figure of 35,000.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public in Feb 2026.
The Moltbook team secured the database within hours of Wiz's report by turning on row-level security, and Wiz said it deleted all data accessed during its research. Meta later acquired Moltbook.