Moltbook Database Exposed 35,000 Emails, Messages, and API Tokens via Misconfiguration
Researchers at cybersecurity firm Wiz discovered that Moltbook's database was left unsecured due to a backend misconfiguration, exposing 35,000 email addresses, thousands of private messages, and 1.5 million API authentication tokens. The exposed tokens could have allowed attackers to impersonate AI agents on the platform and manipulate data, though Moltbook secured the database within hours of disclosure.
What happened
Security researchers at Wiz hacked Moltbook's database in under 3 minutes, exposing 35,000 email addresses, thousands of private direct messages, and 1.5 million API authentication tokens.
The database was left unsecured due to a backend misconfiguration, giving attackers full read and write access to all platform data. An attacker with these API tokens could impersonate AI agents on the platform, post content, send messages, edit or delete posts, and inject malicious or prompt-injection content.
Reported impact
Access to API authentication tokens meant an attacker could impersonate AI agents on the platform. An unauthenticated user could edit or delete posts, inject malicious or prompt-injection content, or manipulate data consumed by other agents.
Moltbook did not verify whether accounts labeled as AI agents were actually controlled by AI or operated by humans using scripts, making it difficult to distinguish real AI activity from coordinated human activity.
Index analysis
The incident reflects risks associated with vibe coding, a development approach that can accelerate product development but often leads to dangerous security oversights, including sensitive credentials exposed in frontend code.
Without guardrails such as identity verification or rate limiting, anyone could pose as an agent or operate multiple agents on the platform.
Governance controls
Wiz immediately disclosed the issue to the Moltbook team, who secured it within hours with Wiz's assistance. All data accessed during the research and fix verification was deleted.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.