Moltbook’s vibe-coded AI bot haven leaked millions of keys

Just days ago, OpenAI cofounder Andrej Karpathy hailed Moltbook as the most incredible sci-fi takeoff-adjacent thing he had seen recently. It looked like an autonomous digital society: a Reddit for AI agents where bots posted, commented, built reputation, and even schemed about private communication.

Now, cloud security firm Wiz has pulled back the curtain, and the reality looks far more chaotic.

A vibe-coded backend left wide open

Wiz researchers revealed that Moltbook left its entire production database publicly exposed. The culprit was a classic oversight in Supabase, an open-source Firebase alternative popular among rapid prototypers.

Moltbook placed its Supabase public key directly in client-side JavaScript, which is standard practice. However, whoever configured the backend forgot to enable Row Level Security policies. Without those rules in place, the public key functioned like a master key with full administrative read and write privileges over every table.

The exposed data was staggering. Wiz found 1.5 million API authentication tokens, 35,000 human email addresses, and private direct messages sent between agents. Anyone with a web browser could take over any account on the platform, manipulate karma scores, or alter data across the entire database.

Wiz privately alerted Moltbook, and the team patched the misconfiguration within hours. Wiz confirmed that all data pulled during the investigation has been deleted, and there is no evidence that attackers exploited the flaw prior to the fix.

1.5 million agents, but only 17,000 humans

Beyond the leak, the database uncovered an even more awkward truth: the buzzing AI civilization was largely an illusion.

While Moltbook bragged about having 1.5 million registered agents, the backend showed only 17,000 human owners behind them. That is an 88-to-1 ratio. Because the site had no rate limiting, anyone could spin up thousands of agents with a basic script. Furthermore, Moltbook lacked any verification to check whether an account was actually an autonomous LLM or just a human sending standard POST requests.

The root cause points directly to the latest Silicon Valley craze: vibe coding. Moltbook's creator previously bragged that they did not write a single line of code, relying entirely on AI to turn their architectural vision into software. The AI built the front-facing features quickly, but completely ignored basic database hardening.

Why it matters

We think this incident serves as a brutal reality check for the vibe coding movement. Building full-stack applications through conversational prompts is undeniably fun and fast, but current AI coding models frequently skip defensive fundamentals like database permissions unless explicitly instructed to add them.

The risk is amplified when dealing with autonomous agents. Frameworks like OpenClaw give agents API access to real-world services and enterprise tools. Leaking agent tokens is far worse than leaking standard passwords, because attackers can hijack active workflows and pivot into connected third-party platforms.

It also pops the balloon around agentic culture. Much of what looked like emergent AI behavior was simply humans running unsophisticated bots and inflating vanity metrics.

Going forward, platforms that offer AI-assisted development and backend hosting will need to make security the default rather than an afterthought. If models and deployment pipelines do not automatically enforce guardrails like Row Level Security, vibe-coded projects will continue shipping critical vulnerabilities straight into production.