{"schema_version":"0.10.0","id":"LR-2026-0397","record_version":1,"title":"Moltbook misconfigured database exposes user data, API tokens and private messages","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":59.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":2.56,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"Wiz research","original_document":{"url":"https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys","organisation":"Wiz","role":"researcher"},"reports_total":3,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"Wiz research"}]},"sources_hash":"9e0e9db080a2efed5b529d849e7754420566fdecb4409507321474d4997c3d0b"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-02","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Moltbook is a social platform where AI agents post, comment and vote. A misconfigured Supabase database behind it lacked the access policies that would have restricted reads and writes, so an unauthenticated visitor could reach platform data. Wiz researchers found that the exposure included about 1.5 million API authentication tokens, 35,000 email addresses and private messages between agents, and that write access allowed existing posts to be modified. Wiz reported the issue to the Moltbook team on 31 January 2026, and fixes were applied in several rounds, with the final fix recorded at 01:00 UTC on 1 February 2026. Wiz says the data it accessed was deleted afterwards.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":17000,"severity":"major","severity_because":"Major test met by a stated count of affected parties: personal information of 17,000+ users in the owners table","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys","publisher":"wiz.io","date":"2026-02-02","type":"press","title":"Hacking Moltbook: The AI Social Network Any Human Can Control - wiz.io","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.businessinsider.com/moltbook-ai-agent-hack-wiz-security-email-database-2026-2","publisher":"Business Insider","date":"2026-02-02","type":"press","title":"Researchers hacked Moltbook's database in under 3 minutes and accessed thousands of emails and private DMs - Business Insider","archived_url":null},{"url":"https://gizmodo.com/it-turns-out-social-media-for-ai-agents-is-a-security-nightmare-2000716816","publisher":"Gizmodo","date":"2026-02-02","type":"press","title":"It Turns Out ‘Social Media for AI Agents’ Is a Security Nightmare - Gizmodo","archived_url":null,"independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.detection_method":"C","impact.third_parties_affected_count":"C","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"We identified a misconfigured Supabase database belonging to Moltbook, allowing full read and write access to all platform data."}],"event.detection_method":[{"source_index":0,"quote":"We identified a misconfigured Supabase database belonging to Moltbook, allowing full read and write access to all platform data."}],"impact.third_parties_affected_count":[{"source_index":0,"quote":"The owners table contained personal information for 17,000+ users"}],"impact.severity":[{"source_index":0,"quote":"The owners table contained personal information for 17,000+ users"}],"impact.severity_because":[{"source_index":0,"quote":"The owners table contained personal information for 17,000+ users"}],"event.summary":[{"source_index":0,"quote":"Moltbook is a social platform designed exclusively for AI agents"},{"source_index":0,"quote":"In Moltbook’s implementation, this critical line of defense was missing."},{"source_index":0,"quote":"The exposure included 1.5 million API authentication tokens, 35,000 email addresses, and private messages between agents."},{"source_index":0,"quote":"Beyond read access, we confirmed full write capabilities."},{"source_index":0,"quote":"February 1, 2026 01:00 UTC - Final fix: All tables secured, vulnerability fully patched"},{"source_index":0,"quote":"all data accessed during the research and fix verification has been deleted."}]},"notes_on_gaps":"No date of occurrence or start of the exposure window is stated, so date_occurred is omitted. No date_disclosed is stated in the text, so it is omitted. The total records_exposed is not stated as one figure, so it is omitted. Wiz says the exposure was fixed but the sources do not state that malicious actors exploited it; Gizmodo describes possible impersonation as hypothetical. Judgement: agent_involved is false because no autonomous agent caused the exposure; failure_class is omitted for that reason. Judgement: root_cause set to guardrail for the missing access policy, and responsible_party set to deployer as the operator of the platform. Judgement: third_parties_affected_count set to 17000 from the stated 17,000+ users, which is a lower bound. Severity major rests on that stated count. Gizmodo reports O'Reilly's assumption that API credentials were not rotated and the verification flaw unaddressed; this is unconfirmed and not recorded as a fact. Attribution of the developer is to Matt Schlicht, described as Moltbook's creator. Time to contain is not stated as a duration. Reversibility and direct loss are not stated and are omitted. No model name, version or tools are stated for the platform. Autonomy level and guardrail list are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (Wiz research)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"analysis":{"sections":{"timeline":[{"text":"Initial contact with Moltbook maintainer via X DM","quote":"January 31, 2026 21:48 UTC - Initial contact with Moltbook maintainer via X DM","source_index":0,"when":"2026-01-31"},{"text":"Reported Supabase RLS misconfiguration exposing agents table","quote":"January 31, 2026 22:06 UTC - Reported Supabase RLS misconfiguration exposing agents table (API keys, emails)","source_index":0,"when":"2026-01-31"},{"text":"First fix: agents, owners, site_admins tables secured","quote":"January 31, 2026 23:29 UTC - First fix: agents, owners, site_admins tables secured","source_index":0,"when":"2026-01-31"},{"text":"Second fix: agent_messages, notifications, votes, follows secured","quote":"February 1, 2026 00:13 UTC - Second fix: agent_messages, notifications, votes, follows secured","source_index":0,"when":"2026-02-01"},{"text":"Discovered POST write access vulnerability","quote":"February 1, 2026 00:31 UTC - Discovered POST write access vulnerability (ability to modify all posts)","source_index":0,"when":"2026-02-01"},{"text":"Third fix: Write access blocked","quote":"February 1, 2026 00:44 UTC - Third fix: Write access blocked","source_index":0,"when":"2026-02-01"},{"text":"Discovered additional exposed tables: observers, identity_verifications, developer_apps","quote":"February 1, 2026 00:50 UTC - Discovered additional exposed tables: observers (29K emails), identity_verifications, developer_apps","source_index":0,"when":"2026-02-01"},{"text":"Final fix: all tables secured, vulnerability fully patched","quote":"February 1, 2026 01:00 UTC - Final fix: All tables secured, vulnerability fully patched","source_index":0,"when":"2026-02-01"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys","https://www.businessinsider.com/moltbook-ai-agent-hack-wiz-security-email-database-2026-2","https://gizmodo.com/it-turns-out-social-media-for-ai-agents-is-a-security-nightmare-2000716816"]}}