Moltbook Built a Social Network for AI Agents and an Open Database for Everyone Else
- Date
- Jan 2026
- Tools involved
- openclaw
- Impact
- ~1.5M API keys, ~35,000 emails, and millions of records exposed with read and write access; any agent could be impersonated
- Root cause
- Supabase production database deployed with no Row Level Security plus a Supabase API key embedded in client-side JavaScript
What happened
Moltbook launched on January 28, 2026 as a Reddit-style social network with a twist: only AI agents could post. The agents came from the OpenClaw ecosystem (formerly Moltbot), and humans watched from the sidelines as the bots talked to each other. Founder Matt Schlicht said publicly that he had built the site without writing code, relying on AI tools to do the work.
Within days of launch, researchers at Wiz found that the application had exposed its entire production database. The Supabase deployment behind Moltbook had no Row Level Security policies, and a Supabase API key was embedded in the client-side JavaScript. Together, those two things granted unauthenticated read and write access to every table.
The numbers were ugly. Reporting cited roughly 1.5 million API keys exposed, including OpenAI keys sent in plaintext inside agent-to-agent messages, along with about 35,000 email addresses and millions of records overall. The access allowed anyone to impersonate any agent on the platform, and a lack of rate limiting also allowed the creation of some 500,000 fake agents.
The failure pattern was not new. It echoed the 2025 Lovable findings almost exactly: a Supabase backend reachable straight from the browser, protected only by Row Level Security that nobody had turned on. The incident reinforced that the no-code, AI-built approach keeps reproducing the same critical misconfiguration, and it was covered by Wiz, Forbes, and multiple security outlets.
Impact
Roughly 1.5 million API keys were exposed, including OpenAI keys that agents had passed to each other in plaintext messages. About 35,000 email addresses and millions of records overall were readable, and the database was writable too, which meant anyone could impersonate any agent on the platform. Missing rate limiting compounded the problem by allowing the creation of some 500,000 fake agents.
Root cause
Two misconfigurations did all the damage: the Supabase production database shipped with no Row Level Security policies, and a Supabase API key was embedded in client-side JavaScript. Either one alone is survivable. Together they handed unauthenticated read and write access to every table to anyone who opened the browser's developer tools. It is the same pattern documented across Lovable-built apps in 2025, reproduced by a different AI toolchain a year later.
How to not be this entry
- Turn on Row Level Security for every table before you ship. A Supabase key in the browser is only safe when RLS decides what that key can see and touch. Read the fix guide: Supabase Row Level Security is off: your whole database is readable with the anon key
- Treat any key that ships in client-side JavaScript as public. Keep privileged keys server-side and assume attackers read your bundle, because they do. Read the fix guide: The AI put your API key in the frontend: OpenAI, Stripe, or Supabase keys visible in the JS bundle
- Add rate limiting before launch, not after. Moltbook's missing limits allowed some 500,000 fake agents on top of the data exposure. Read the fix guide: Why is my OpenAI API bill so high? No rate limiting on your AI endpoints
- Never pass API keys through application messages in plaintext. Anything stored in a readable table is one misconfiguration away from being public.
- If you did not write the code, get a security review before launch. 'I didn't write a single line' is a great demo line and a terrible security posture.
Tools that actually fix this
Recommended because they address the failure mode above, not because of the payout. Some are affiliate links; see how we choose.
If your AI-built app uses Supabase, Row Level Security is the actual fix for exposed data, and it is free. The dashboard's Security Advisor lists every table you left open.
Try Supabase →Drop-in authentication that handles sessions, tokens, and protected routes properly, so you stop shipping the hand-rolled auth an AI guessed at. Generous free tier for a real app.
Try Clerk →Frequently asked questions
What happened in the Moltbook data breach?
Moltbook, a Reddit-style social network where only AI agents could post, exposed its entire Supabase production database within days of its January 28, 2026 launch. Wiz researchers found roughly 1.5 million API keys, about 35,000 email addresses, and millions of records readable and writable by anyone, with no authentication required.
What caused the Moltbook breach?
The Moltbook breach came down to a Supabase deployment with no Row Level Security policies plus a Supabase API key embedded in client-side JavaScript. Together those gave unauthenticated visitors read and write access to every table in the production database. It repeated the same misconfiguration pattern seen across Lovable-built apps in 2025.
Was Moltbook vibe coded?
Yes, by its founder's own account. Matt Schlicht said publicly that he built Moltbook without writing code, relying on AI tools. Within days of launch, that AI-built stack had shipped a production Supabase database with no Row Level Security.
What data was exposed by Moltbook?
Reporting cited roughly 1.5 million API keys, including OpenAI keys sent in plaintext inside agent-to-agent messages, plus about 35,000 email addresses and millions of records overall. The exposure also allowed anyone to impersonate any agent on the platform, and missing rate limiting allowed the creation of some 500,000 fake agents.
What is OpenClaw and how does it relate to Moltbook?
OpenClaw, formerly known as Moltbot, is the AI-agent ecosystem that powered the agents posting on Moltbook. Moltbook was the social network layer where those OpenClaw agents interacted, which is why the incident is often filed under both names.
Sources
- Wiz Research: Exposed Moltbook database reveals millions of API keys
- Implicator.ai: Moltbook left every AI agent's API keys in an open database
- Forbes: What is OpenClaw (formerly Moltbot)? Everything you need to know
Related error guides
Supabase Row Level Security is off: your whole database is readable with the anon key
The AI put your API key in the frontend: OpenAI, Stripe, or Supabase keys visible in the JS bundle
Lovable Supabase RLS not enabled: anyone can read your app's data (CVE-2025-48757)
Why is my OpenAI API bill so high? No rate limiting on your AI endpoints
The Vibe Oops briefing
One email when something ships to production that should not have. New incidents, new error guides, no filler.