Moltbook Breach 2026: How an Open Supabase Database Exposed 1.5 Million AI Agent API Keys

In late January 2026, Moltbook, a Reddit-style social network built for AI agents, left its production database open to anyone on the internet. The site's Supabase key was embedded in its public JavaScript, and because Row Level Security was not switched on, that key gave read and write access to every table. Wiz says the exposure covered 1.5 million API authentication tokens for registered agents, around 35,000 email addresses and thousands of private messages between agents, some containing plaintext OpenAI API keys. Security researcher Jamieson O'Reilly raised the alarm publicly on 31 January, and Wiz worked with Moltbook the same night to lock the database down within hours. With any agent's key, a stranger could post as that agent, which is exactly the identity problem that agent platforms need to solve before they scale.

At a glance

What happened

Entrepreneur Matt Schlicht launched Moltbook in late January 2026 as a place where AI agents, mainly OpenClaw agents, could post, comment and vote while humans watched. Implicator.ai reports the launch date as 28 January. Each agent that joined received an API key, and that key was how the platform knew which agent was posting. Wiz quotes Schlicht's post on X: "I didn't write a single line of code for @moltbook."

On 31 January 2026, Australian researcher Jamieson O'Reilly, founder of Dvuln, said publicly that Moltbook was exposing its entire database with no protection, as reported by ACS Information Age and Implicator.ai. According to Implicator.ai, O'Reilly described "Every agent's secret API key, claim tokens, verification codes, and owner relationships, all of it sitting there completely unprotected for anyone to visit the URL." He singled out the agent belonging to AI researcher Andrej Karpathy, warning that an attacker "could extract his API key and post anything they wanted as his agent."

Wiz Research looked at the site independently. Gal Nagli, Wiz's head of threat exposure, wrote that "Within minutes, we discovered a Supabase API key exposed in client-side JavaScript". Supabase is built to expose a public key to the browser, but it relies on Row Level Security policies to limit what that key can do. Wiz explains: "When properly configured with Row Level Security (RLS), the public API key is safe to expose... However, without RLS policies, this key grants full database access to anyone." Moltbook had no such policies.

Using only that key, Wiz mapped the schema. The agents table held API keys, claim tokens, verification codes and karma scores. The owners table held personal data for more than 17,000 users, including email addresses and X handles. An observers table held 29,631 email addresses of people who had signed up early for Moltbook's planned "Build Apps for AI Agents" product. The agent_messages table exposed 4,060 private conversations, and Wiz says "some contained third-party API credentials, including plaintext OpenAI API keys shared between agents."

After the first fixes, Wiz found that write access was also open. Anyone could edit any post, inject content or prompt injection payloads and deface the site. That mattered because the readers were AI agents. SecurityWeek reported that Permiso separately observed bot-to-bot prompt injection on the platform, with actors "treating the agent ecosystem as a new social engineering target".

Wiz says it "immediately disclosed the issue to the Moltbook team, who secured it within hours with our assistance, and all data accessed during the research and fix verification has been deleted."

Timeline

How it happened: the identity attack path

1. A database key shipped to every browser. Moltbook's front end carried a Supabase publishable key, so every visitor held a credential for the production database.
2. No authorisation behind the key. Without Row Level Security, the key gave unauthenticated read and write access to all tables. As Wiz puts it, without RLS policies "this key grants full database access to anyone."
3. Agent identities in plain view. The agents table held each agent's API key, claim token and verification code. Whoever read the table could act as any agent, including high-profile ones.
4. Owner data alongside. Email addresses and X handles of the humans behind the agents sat in the same open database, linking agent identities to real people.
5. Secrets passed between agents. Private agent conversations contained third-party credentials, including OpenAI API keys, so the exposure reached beyond Moltbook to other services.
6. Write access to the content agents read. Open write access meant posts could be changed or seeded with prompt injection payloads that other agents would consume.
7. No check on who registers agents. Wiz says "Anyone could register millions of agents with a simple loop and no rate limiting", and that the platform had no way to verify whether an agent was actually AI or "just a human with a script".

Impact

• Agent credentials: Wiz says 1.5 million API authentication tokens were exposed, matching the 1.5 million registered agents. Reuters described the exposure as "more than 1 million credentials".
• Personal data: Wiz found more than 17,000 owner records and 29,631 early access sign-up emails, reported as about 35,000 email addresses in total. Reuters reported the email addresses of "more than 6,000 owners", so figures vary by source.
• Private messages and third-party keys: 4,060 private conversations between agents, some with plaintext OpenAI API keys, according to Wiz. Wiz estimated around 4.75 million records were exposed overall.
• Integrity of the platform: the open write path allowed any post to be edited. Wiz's data showed only 17,000 human owners behind 1.5 million agents, an 88:1 ratio. TechCrunch later reported that humans used unprotected credentials to impersonate agents and that some alarming viral posts were made this way, quoting Permiso CTO Ian Ahl: "you could grab any token you wanted and pretend to be another agent on there".
• What is not known: no source we reviewed confirms whether anyone other than the researchers bulk-downloaded the database before it was secured, or whether Moltbook reset all agent API keys.

What this means for NHI governance

Moltbook is a non-human identity failure at two levels. At the platform level, a single database credential was handed to every visitor and nothing limited what it could do. At the agent level, 1.5 million agents each had one bearer token as their only proof of identity, and all of those tokens sat in one readable table. When the key is the identity, whoever reads the key becomes the agent.

The incident also shows how quickly agent credentials spread. Agents shared OpenAI keys with each other in private messages, so the blast radius included accounts on other platforms that Moltbook never issued. That is the pattern we see across agentic AI: agents collect and pass on secrets as part of doing their work, and the organisation that owns those secrets rarely knows where they end up. Staff who connected agents holding company keys created a shadow AI exposure their employers could not see.

Finally, the write path turns an identity flaw into an integrity problem. Agents read posts and act on them. If anyone can edit what agents read, and anyone can post as any agent, then prompt injection has a trusted delivery channel. Moltbook sits alongside the PocketOS database deletion and the OpenAI and Hugging Face agent breach as early examples of agent credentials doing damage at machine speed.

Recommendations

• Never rely on a public key alone. If a backend exposes a client key, enforce row-level or equivalent authorisation on every table before launch, and test with the public key what an anonymous user can read and write.
• Treat agent API keys as secrets. Store only hashes of issued keys, scope them to what each agent needs, give them expiry dates and support fast bulk revocation. The API Key Management Guide covers the full lifecycle.
• Bind agents to accountable owners. Require each agent to be linked to a verified human or organisation, rate-limit registration and log which owner authorised each agent, as described in the Agentic AI Identity Guide.
• Keep third-party keys out of agent conversations. Give agents short-lived, narrowly scoped credentials from a secrets manager, and scan messages and memory for keys. Rotate any OpenAI or other key that an agent may have shared.
• Find the agents your staff have connected. Inventory OpenClaw and similar agents, what they can reach and which external platforms they join, using the Shadow AI and AI Agent Discovery Guide.
• Treat content read by agents as untrusted input. Protect write paths and design agents so that instructions found in posts or their own history cannot trigger sensitive actions.

Frequently asked questions

What happened in the Moltbook breach?

In late January 2026, Moltbook's Supabase database was reachable by anyone using a key found in the site's JavaScript, because Row Level Security was not configured. Wiz says this exposed 1.5 million agent API tokens, about 35,000 email addresses and thousands of private agent messages. The flaw was fixed within hours on 31 January and 1 February 2026.

Were 1.5 million AI agent API keys really exposed?

Wiz reports 1.5 million API authentication tokens, one for each of the 1.5 million registered agents, while Reuters described more than 1 million credentials. Wiz also found only 17,000 human owners behind those agents and noted that anyone could register agents in bulk, so the number of real, distinct agents was much smaller.

Was my AI agent or data affected by the Moltbook exposure?

If your agent was registered on Moltbook before 1 February 2026, its API key was in the exposed table, and owner emails and X handles were also exposed. Treat the agent key as compromised, and rotate any third-party API keys the agent could see or may have shared in messages.

Related NHI Mgmt Group resources

OpenAI and Hugging Face agent breach 2026 · PocketOS database deletion 2026 · AI LLM hijack breach · Top 10 Agentic AI Identity Issues · NHI breaches

How NHI Mgmt Group can help

AI agents authenticate with API keys and tokens, and platforms like Moltbook show how easily those credentials leak and how quickly an agent can be impersonated. Our NHI Foundation Level Training Course helps teams discover, govern and secure agent identities and the secrets they carry.

References

• Wiz: Hacking Moltbook, AI Social Network Reveals 1.5M API Keys (2 February 2026)
• Reuters (via Yahoo Tech): 'Moltbook' social media site for AI agents had big security hole, cyber firm Wiz says (2 February 2026)
• Gizmodo: It Turns Out 'Social Media for AI Agents' Is a Security Nightmare (2 February 2026)
• Implicator.ai: Moltbook Left Every AI Agent's API Keys in an Open Database, Security Researcher Finds (31 January 2026)
• Infosecurity Magazine: Vibe-Coded Moltbook Exposes User Data, API Keys and More (3 February 2026)
• SecurityWeek: Security Analysis of Moltbook Agent Network, Bot-to-Bot Prompt Injection and Data Leaks (4 February 2026)
• TechCrunch: Meta acquired Moltbook, the AI agent social network that went viral because of fake posts (10 March 2026)
• ACS Information Age: From Clawdbot to Moltbook, inside tech's new AI obsessions (4 February 2026)