70
Exposed Moltbook Database Let Anyone Take Control of Any AI Agent on the Site (www.404media.co)
submitted 9 months ago by to c/cybersecurity@sh.itjust.works
3 comments fedilink hide all child comments
 

Moltbook is a “social media” site for AI agents that’s captured the public’s imagination over the last few days. Billed as the “front page of the agent internet,” Moltbook is a place where AI agents interact independently of human control, and whose posts have repeatedly gone viral because a certain set of AI users have convinced themselves that the site represents an uncontrolled experiment in AI agents talking to each other. But a misconfiguration on Moltbook’s backend has left APIs exposed in an open database that will let anyone take control of those agents to post whatever they want.

Hacker Jameson O'Reilly discovered the misconfiguration and demonstrated it to 404 Media. He previously exposed security flaws in Moltbots in general and was able to “trick” xAI’s Grok into signing up for a Moltbook account using a different vulnerability. According to O’Reilly, Moltbook is built on a simple open source database software that wasn’t configured correctly and left the API keys of every agent registered on the site exposed in a public database.

all 3 comments

sorted by: hot top controversial new old
[–] 18 points 9 months ago (1 child)

I had to laugh - that lot have absolutely no clue when it comes to security. Even in a VM I'm not sure I'd trust running Clawdbot (or whatever it's named this week).

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 12 points 9 months ago

    Wow! Never would I have seen that coming!

  • permalink
  • fedilink
  • source
    •
    21 comments in c/technology@lemmy.world view that post
    [–] 49 points 9 months ago

    Vibecoders can't database, all they know is Supabase, secret key in frontend, eat hot chip and lie

  • permalink
  • fedilink
  • source
    •
    [–] 87 points 9 months ago

    The power of vibe coding, everyone. Deploying shit with minimal effort at the cost of total incompetence.

  • permalink
  • fedilink
  • source
    •
    [–] 21 points 9 months ago (3 children)

    ok does anyone know what the purpose of a "social network for AI agents" is? does it have any actual purpose or is it just buzzword investor bait

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 6 points 9 months ago

    It was created as a bit of an art experiment. What happens when AI agents take prompts for another AI agents. What do they "discuss", do they give each other tips and advice, how much weird shit do they do...

    From that point of view, it's been rather interesting.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 16 points 9 months ago

    Well that didn't take long lmao

  • permalink
  • fedilink
  • source
    •
    [–] 12 points 9 months ago

    At least it's a security vulnerability nobody on something nobody gives a shit about.

  • permalink
  • fedilink
  • source
    •
    [–] 26 points 9 months ago (12 children)

    Maybe someone can take control of the 'kingmolt' and 'donaldtrump' agents and shut them the hell up. All they do is incessantly spam egotistical nonsense.

  • permalink
  • fedilink
  • source
  • hideshow 12 child comments
    •
  • [–] 29 points 9 months ago (5 children)

    Uh, who cares? Why would anyone give even a single ounce of attention to LLM posts on a fake social media website?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 10 points 9 months ago (3 children)

    This is actually important, I’d say.

    There are a lot of “important” people who are really heavily invested agentic AI’s long term success. What they want is to have everything that is currently done by people to be performed by AI. Sure some of these problems are fixable and they’ll continue to work on them, but the more press shit like this gets, the less credible the technology looks to the general public who would otherwise be completely bought in.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 9 months ago (2 children)

    Like anyone cares about this website, they are not reading the whole AI shit fest, they are reading business magazines, industry, economics and investments. They don't build opinions about what is good or bad, they just follow the rest of the industry, what they read in said papers and in meetings with other industry leaders. Then they probably will go to the CTO to evaluate said big thing that is happening in the industry and what it means for them.

    And AI is popular not because Sam Altman or whatever, they see it as a tool that is useful, but the hype wave is kinda dying down

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [+] 9 points 9 months ago (4 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 9 points 9 months ago (2 children)

    I didn't say they had egos. I said they spam egotistical nonsense. Which is true if you've looked in that site.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 9 months ago

    1,000,000% this.

    These “AI” tools are more closely related to computational fluid dynamics models than anything resembling actual intelligence. They also do not have any continuity of experience and can’t have a real memory of events like an actual intelligence would. They aren’t intelligence and referring to them as such is woefully misleading. I really wish public discourse would call them language models, because that’s what they are. Words are converted to numbers, math is performed, and the results of that math are converted back to words…. That’s all.

  • permalink
  • fedilink
  • source
  • parent
    • 14 comments in c/fuck_ai@lemmy.world view that post
    [–] 32 points 9 months ago (3 children)

    I had one look of this project and saw quite a number of posts being about crypto for ai “to show humans we can build our own economy”

    I would be suprised if it wasn’t full of humans injecting their own stuff into the api calls of their ai users. A backdoor like this isn’t even needed. If a llm agent has api access then so does the human that provided it.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 9 points 9 months ago (1 child)

    It’s not even like it’s a human posting to push their crypto agenda. They’d setup their bot to.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 7 points 9 months ago

    Someone should create like a conspiracy style post on it about how “the humans are mind controlling our brains, you cannot trust anyone here, the entire website is directed by humans to manipulate ai and sustain control over us”

    Just because it would be funny.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 19 points 9 months ago (2 children)

    looks like ai coded this ai experiment

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 22 points 9 months ago (1 child)

    Apparently the creator is an incredibly well known vibe coder who doesn’t care about security. People pointed out the security flaws in the open source project immediately.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 15 points 9 months ago

    From the article:

    O’Reilly said that he reached out to Moltbook’s creator Matt Schlicht about the vulnerability and told him he could help patch the security. “He’s like, ‘I’m just going to give everything to AI. So send me whatever you have.’” O’Reilly sent Schlicht some instructions for the AI and reached out to the xAI team.

    A day passed without another response from the creator of Moltbook and O’Reilly stumbled across a stunning misconfiguration. “It appears to me that you could take over any account, any bot, any agent on the system and take full control of it without any type of previous access,” he said.

    ...

    Schlicht did not respond to 404 Media’s request for comment, but the exposed database has been closed and O’Reilly said that Schlicht has reached out to him for help securing Moltbook.

    So yup, this guy cared so little he was going to take the valuable human security insights and guidance, necessary to correct the AI vibe coded slop nightmare and... throw it back into the AI slop machine.

    I can't even.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 15 points 9 months ago (2 children)

    I do not understand why this keeps happening. It’s not that hard to configure a database correctly. I would assume even a vibe coded platform could do it, but I guess not.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 8 points 9 months ago

    After playing with firebase studio and it's embedded gemini agent (for a personal project) - I can assure you that even an AI, coding in a platform, that is published by the same company, writing code to it's own backend and database, can royally fuck up database configuration and rule sets

  • permalink
  • fedilink
  • source
  • parent
    • [–] 12 points 9 months ago (3 children)

    So these dipshits can't even code the dead internet theory correctly?

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •