Moltbook Database Exposure Allegedly Revealed Users' Private Communications and API Authentication Tokens

Wiz researchers reported accessing an exposed Moltbook database in under three minutes, allegedly obtaining ~35,000 email addresses, thousands of private DMs, and ~1.5 million API authentication tokens. The exposure was described as enabling read/write access and potential impersonation or manipulation of "AI agent" accounts. Wiz said it disclosed the issue to Moltbook, which reportedly secured the database within hours and deleted accessed data.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The incident involves a critical security vulnerability in the Moltbook platform (a social network for AI agents) that allowed unauthorized access to database credentials and API tokens.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The vulnerability exposed 35,000 user email addresses and thousands of private direct messages.

Causal factors

• Entity: Human
• Intent: Unintentional
• Timing: Post-deployment

The security vulnerability was caused by human developers' backend misconfiguration and 'vibe coding' oversights, which was an unintentional error discovered after the platform was deployed.

EU AI Act risk tier

• Risk tier: 4 Minimal or No Risk

Minimal or No Risk: The system is a social network for AI agents used for entertainment and experimentation, posing low or negligible risks to society under the EU AI Act.

AI system and alleged parties

• AI system: OpenClaw
• AI purpose: Social Media Content Generation; Chatbot
• Behaviour type: Multi-agent
• Alleged developer: Moltbook
• Alleged deployer: Moltbook platform operators, Moltbook
• Alleged harmed parties: Moltbook users, Moltbook account holders

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes privacy violations caused directly by the incident, specifically the exposure of sensitive user data.

Directly caused: The database vulnerability directly exposed 35,000 email addresses and thousands of private direct messages to security researchers.

Inferred additional harm: It is possible that other unauthorized parties accessed the unsecured database prior to Wiz's discovery, potentially exposing the same user data to malicious actors.

People affected

• Occurrences reported: 1
• People reportedly exposed: 35000

Potential causes

Management

• Prioritizing Speed Over Security: Rapid deployment driven by viral hype took precedence over security protocols.
• Inadequate Risk Assessment: Failure to assess security risks of hosting autonomous AI agent interactions.

Technology

• Backend Misconfiguration: Backend was left unsecured, allowing full read and write database access.
• Exposed API Tokens: 1.5 million API authentication tokens were exposed in the database.
• Lack of Agent Verification: No verification if accounts were actual AI agents or scripted humans.

Data Inputs

• Unvalidated Prompt Inputs: Lack of input validation allows injection of malicious prompt-injection data.

Human Factors

• Vibe Coding Reliance: Creator relied entirely on AI to generate code without manual verification.
• Overconfidence in AI Code: Assuming AI-generated code is secure without conducting security audits.

Process and Methods

• Lack of Identity Verification: No mechanisms to verify if accounts are AI agents or automated scripts.
• Absence of Rate Limiting: Lack of rate limiting allowed potential mass automated exploitation.
• Deficient Code Review: No manual code review or security testing before shipping the application.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides clear, specific details about the security vulnerability, the data exposed (35,000 emails, 1.5 million tokens), the party that discovered it (Wiz), and the resolution.
• Ambiguities identified: It is slightly unclear whether any malicious actors accessed the database before Wiz discovered the vulnerability, though no active exploitation was reported.
• Alternative interpretations: None.

A critical database misconfiguration on the Moltbook platform exposed user emails and API tokens. The issue was quickly secured by the team after disclosure by Wiz researchers. The incident represents a standard cybersecurity vulnerability with negligible national security implications.

• Overall national security impact: Negligible
• Scope: Unknown
• Primary target: No clear primary
• Other affected: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The vulnerability was patched immediately upon discovery, leaving no active threat, though it highlights long-term secure development concerns.
• Autonomy: Human-controlled. The incident was caused entirely by human backend misconfiguration and 'vibe coding' practices during development.
• Novelty: Established threat. Database misconfigurations and credential exposure are well-established, common cybersecurity vulnerabilities.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or kinetic capabilities were affected or threatened by this database misconfiguration.
• Information security: Negligible. No classified systems, state-sponsored information operations, or intelligence capabilities were compromised.
• Sovereignty: Negligible. No government systems, electoral processes, or state sovereignty functions were impacted by this incident.
• Economic security: Negligible. The incident involved a non-critical social network. No strategic technologies, financial systems, or critical supply chains were compromised.
• Societal stability: Negligible. While 35,000 user emails were exposed, this constitutes a standard data privacy issue rather than a threat to national societal stability or systemic human rights.