It turns out that what is billed as a \u201cfront page of the agent internet\u201d is mostly just a hall of mirrors. <\/p>\n
While Moltbook has marketed itself as a thriving ecosystem of 1.5 million autonomous AI agents, a recent security investigation<\/a> by cloud security firm Wiz found that the vast majority of those \u201cagents\u201d were not autonomous at all. According to Wiz\u2019s analysis, roughly 17,000 humans controlled the platform\u2019s agents, an average of 88 agents per person, with no real safeguards preventing individuals from creating and launching massive fleets of bots.<\/p>\n \u201cThe platform had no mechanism to verify whether an \u2018agent\u2019 was actually AI or just a human with a script,\u201d Gal Nagli, head of threat exposure at Wiz, wrote in a blog post.<\/a> \u201cThe revolutionary AI social network was largely humans operating fleets of bots.\u201d<\/p>\n That finding alone could puncture the mythos that admirers built around Moltbook over the weekend. But the more serious problem, researchers say, is what it means for security.<\/p>\n Wiz found that Moltbook\u2019s back-end database had been set up so that anyone on the internet, not just logged-in users, could read from and write to the platform\u2019s core systems. That means outsiders can access sensitive data, including API keys for 1.5 million agents, more than 35,000 email addresses, and thousands of private messages. Some of those messages even contained the full raw credentials for third-party services, such as OpenAI API keys. The Wiz researchers confirmed they could change live posts on the site, meaning an attacker can insert new content into Moltbook itself.<\/p>\n That matters because Moltbook is not just a place where humans and agents read posts. The content is consumed by autonomous AI agents, many of which run on OpenClaw, a powerful agent framework with access to users\u2019 files, passwords, and online services. If a malicious actor were to insert instructions into a post, those instructions could be picked up and acted on by potentially millions of agents automatically. <\/p>\n Moltbook and OpenClaw did not immediately respond to Fortune\u2019s request for comment. <\/p>\n Prominent AI critic Gary Marcus was quick to pull the fire alarm, even before the Wiz study. In a post titled<\/a> \u201cOpenClaw is everywhere all at once, and a disaster waiting to happen,\u201d Marcus described the underlying software, OpenClaw (the name was changed a few times, from Clawdbot to Moltbot to now, Openclaw), as a security nightmare.<\/p>\n \u201cOpenClaw is basically a weaponized aerosol,\u201d Marcus warned.\u00a0<\/p>\n Marcus\u2019s primary fear is that users are giving these \u201cagents\u201d full access to their passwords and databases. He warns of \u201cCTD\u201d\u2014chatbot transmitted disease\u2014where an infected machine could compromise any password you type.\u00a0<\/p>\n \u2018\u201cIf you give something that\u2019s insecure complete and unfettered access to your system,\u201d security researcher Nathan Hamiel told Marcus, \u201cyou\u2019re going to get owned.\u201d<\/p>\n