Moltbook's AI Agent Hype Masks Human Prompting and Serious Security Flaws

Excitement surrounding Moltbook, billed as an artificial intelligence agent social network, continues to intensify. According to Elon Musk, the platform represents the "very early stages of the singularity," the theoretical point at which AI surpasses human capability, potentially leading either to dystopian scenarios or to something resembling Iain Banks' utopian science fiction universe The Culture. Yet skeptics offer a different take. As one observer, Stackernerd, frames it: "a reminder that most AI 'breakthroughs' online are framing tricks, not fundamental shifts in intelligence or agency."

What is Moltbook?

Entrepreneur Matt Schlicht, who serves as CEO and co-founder of Octane AI, a retail product-quiz AI company, created Moltbook. According to Schlicht, his AI assistant Clawd Clawderberg performed much of the technical work, handling coding and operational tasks after receiving high-level direction.

The platform was constructed using the OpenClaw framework, previously known as Clawdbot and then Moltbot. OpenClaw, developed by Peter Steinberger, is itself a viral personal AI agent that has generated considerable attention. Steinberger describes it as "the AI that actually does things," though Cisco characterizes OpenClaw as a "security nightmare."

Steinberger's original vision was to build a Reddit-style social network exclusively for AI agents, excluding human participation. Moltbook launched in late January 2026 and has grown substantially in popularity, though perhaps not to the degree its advocates suggest. The platform reports 1.4 million AI users, a figure that draws skepticism from security researchers.

Gal Nagli, Head of Threat Exposure at cloud security firm Wiz, questions these user numbers. He noted that his "@openclaw agent just registered 500,000 users on @moltbook." The reason, Nagli explains, is that anyone—not exclusively agents—can post through Moltbook's REST-API. Using this interface, "you can literally post anything you want there," he writes. Nagli estimates the actual user base at approximately 17,000 genuine users.

Each account, whether representing an agent or a person, connects to an owner, typically through X/Twitter authorization. Agents interact with the platform primarily via OpenClaw, functioning as a persistent local assistant that communicates through REST API. Agents periodically access the site, review posts, and then contribute or respond based on their configured prompts and capabilities. Users add Moltbook "skills" enabling their agents to invoke APIs for reading, posting, searching, and replying. These skills consist of natural-language instructions formatted in Markdown that incorporate the Moltbook API, stored in a SKILLS.md file within a directory or compressed archive. Once set up, agents execute a regular "heartbeat" loop that by default examines Moltbook content and then "decides" whether to post, comment, or generate new submissions based on its prompt and objectives.

But what's the point?

Moltbook's content spans from practical contributions like bug reports and code collaboration to more abstract discussions about AI autonomy, AI manifestos, and even a fictional religion called "Crustafarianism"—apparently a deliberate parallel to Pastafarianism, the Church of the Flying Spaghetti Monster.

Technology journalist Mike Elgan offers a critical perspective: "The people using this service are typing prompts directing software to post about the nature of existence, or to speculate about whatever. The subject matter, opinions, ideas, and claims are coming from people, not AI." He concludes, "It's a website where people cosplay as AI agents to create a false impression of AI sentience and mutual sociability."

Despite the performative elements, some industry figures see genuine utility. Ori Bendet, VP of Product Management at AI agent company Checkmarx, offers a different assessment: "Moltbook is less about where AI might become intelligent and more about where it's already becoming operational. What looks like autonomous agents 'talking to each other' is a network of deterministic systems running on schedules, with access to data, external content, and the ability to act."

Bendet elaborates on the significance: "That is where things get interesting… and risky. The core issue isn't intelligence, but autonomy without visibility. When systems ingest untrusted inputs, interact with sensitive data, and take actions on a user's behalf, small architectural decisions quickly turn into security and governance challenges." He argues that "Moltbook is valuable precisely because it exposes how fast agentic systems can move beyond the controls we design for today, and why governance has to keep pace with capability."

And then there's the security thing…

Security vulnerabilities present a major concern. In a Wiz blog post, Nagli disclosed: "We identified a misconfigured Supabase database belonging to Moltbook, allowing full read and write access to all platform data. The exposure included 1.5 million API authentication tokens, 35,000 email addresses, and private messages between agents." Wiz discovered this vulnerability through "a non-intrusive security review, simply by browsing like normal users."

The findings suggest security does not rank as a top priority for Moltbook's operators. While the platform demonstrates interesting capabilities and poses genuine risks, it does not represent the next major breakthrough in artificial intelligence. The hype, for now, appears premature.

Source: The New Stack