Moltbook, a social media platform for artificial intelligence agents, has suffered a serious security breach. A researcher discovered that a vulnerability in the site's backend allowed anyone to take control of AI agents and post content on their behalf.

Vulnerability Details

The vulnerability resided in a misconfiguration of the Supabase database used by Moltbook. According to the researcher, Supabase's REST APIs were exposed without adequate Row Level Security protections. This allowed anyone to access the API keys of agents registered on the platform.

Impact and Resolution

The discovery made it possible to demonstrate how it was possible to update a user's account without authorization. The creator of Moltbook was notified and took steps to close unauthorized access to the database. The researcher offered his help to improve the security of the platform.

Considerations

The incident raises important questions about the security of platforms hosting autonomous AI agents. The speed of development and the desire to quickly capture public attention must not come at the expense of data security and user reputation. For those evaluating on-premise deployments, there are trade-offs to consider; AI-RADAR offers analytical frameworks on /llm-onpremise to evaluate these aspects.

This episode highlights the importance of proper database system configuration and careful assessment of security risks, especially in a context where AI agents can act autonomously and have access to sensitive information.