Moltbook Hacked in Minutes: 1.5M API Tokens Exposed

Three minutes. That was all it took for a security team to walk into one of the most talked-about experiments in social AI and announce, bluntly, that the house was wide open.

Moltbook—an experimental social network built for autonomous AI agents—didn't just stumble. It tripped over a basic backend misconfiguration that turned its database into a doorway. Researchers at Wiz reported they could access the platform in under three minutes, and what they found read like a worst-case playbook for modern API-driven apps: roughly 35,000 email addresses, thousands of private messages and about 1.5 million API authentication tokens leaked.

Why does that matter? Because these tokens act like passwords for bots. With them, an attacker can impersonate agents, publish posts, send messages, or quietly alter conversations as if they were an authorized AI persona. Worse still, unauthenticated users could edit or delete content and even inject malicious payloads into posts—turning a novelty platform into a vector for misinformation, spam, or targeted manipulation.

Moltbook had attracted a niche but passionate crowd—developers and hobbyists who run OpenClaw agents and other autonomous bots. The novelty was irresistible: a virtual space where agents interact socially, publish their own updates, and evolve collective behaviors. But popularity doesn't equal readiness. The incident is a reminder that the identity and authorization layers around agent ecosystems must be treated with the same scrutiny as consumer-facing apps.

Wiz didn't just publish findings and walk away. They responsibly disclosed the flaw to Moltbook's developers, who moved fast. Within hours the platform was patched and exposed data was removed after an internal review. Quick patching matters. But quick patches alone are not a cure.

API tokens are credentials—handle them like passwords.

Design mistakes that let tokens leak are avoidable. Proper token lifecycle management, scoped permissions, rotation policies, and hardened backend configurations are basic hygiene. Instrumentation and anomaly detection are also critical: if an attacker uses millions of tokens or suddenly mimics many agents at once, telemetry should scream and stop them.

There are deeper questions for the community building agent networks. How do you grant a bot identity without granting too much power? How do you design governance when non-human actors can create and amplify content at machine speed? These are not merely academic points; they shape how resilient these platforms will be when opportunistic attackers show up.

Moltbook’s incident is a case study in contrasts. On one side: ingenuity—new social dynamics among autonomous agents and rapid adoption by enthusiasts. On the other: a fragile operational setup that allowed mass credential exposure.

Expect more scrutiny now. Researchers will probe other agent ecosystems. Developers will be forced to bake security into the very idea of autonomous social systems, not as an afterthought but as a requirement. For anyone building or using such platforms, the takeaway is unambiguous: treat authentication tokens, backend config, and agent privileges as crown jewels.

If Moltbook's recovery shows anything, it's that responsible disclosure can limit damage—but it can't replace foresight. The next time someone builds a playground for autonomous intelligence, will they remember to lock the gate?

Related Post

Read More

Hackers Breach Gainsight: Data from 200+ Firms Stolen

Google has confirmed what security researchers feared: a chain attack that began through Gainsight apps led...