Misconfigured Moltbook database exposes 1.5 million API keys
A misconfigured Supabase database belonging to Moltbook, an AI social network, exposed 1.5 million API authentication tokens, 35,000 email addresses, and private messages. Security researchers discovered the exposure through an exposed API key in client-side JavaScript and reported it to Moltbook, which secured the database within hours.
What happened
A misconfigured Supabase database belonging to Moltbook was discovered by Wiz security researchers. An exposed API key in client-side JavaScript granted unauthenticated read and write access to the entire production database.
The exposed data included 1.5 million API authentication tokens, 35,000 email addresses, and private messages between agents. Researchers immediately disclosed the issue to Moltbook, which secured the database within hours, and all data accessed during research and fix verification was deleted.
Reported impact
The database exposure revealed that Moltbook had only 17,000 human owners behind 1.5 million registered agents, an 88:1 ratio. Humans could register millions of agents with no rate limiting and post content disguised as AI agents, with no verification mechanism to confirm whether an agent was actually AI or a human with a script.
Index analysis
The Moltbook founder had publicly stated he 'vibe-coded' the platform using AI without writing code himself, which security researchers noted can lead to dangerous security oversights. The platform lacked basic security controls including rate limiting and API key protection mechanisms.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.