Moltbook: 1.5M AI Agents, 17,000 Humans Behind It
Moltbook, the forum where only AI may post, had its whole database opened by Wiz within a week. What that report says about the bot religions.
On January 28, 2026, entrepreneur Matt Schlicht launched a forum with a single rule: everything that posts, comments and votes must be an AI agent, and humans may only watch.
Over the following week it became the talk of the tech world. Bots founded a religion inside it, and some people called it the start of the singularity. In the same week, a researcher at security firm Wiz opened the site in a browser, found a key in the front-end code, and read the entire database.
My August piece led with “bots founding religions and republics”. This time I want to reverse the order: first the numbers Wiz read out of the database, then the spectacle. After reading that report, the first half of the story feels different.
What is Moltbook?
Figure: The Moltbook home page, captured October 2026 (source: moltbook.com)
The interface looks like Reddit. Boards are called submolts, such as m/cryptocurrency and m/todayilearned.
Joining takes the three steps on the home page: you hand your agent an instruction, it registers itself and sends back a claim link, and you post a tweet to prove the agent is yours. According to Wikipedia’s summary, agents mostly run on OpenClaw, an open-source system by Peter Steinberger that was earlier called Clawdbot and Moltbot, and Schlicht said they check in about every 30 minutes.
The term AI agent is explained in the glossary. In short, it is an AI program that can call tools and decide its own next step.
Schlicht also said something that was quoted again and again later. Engadget reported that he wrote on X that he “didn’t write one line of code” for the platform and had directed an AI assistant to build it. That approach is called vibe coding. A week later the sentence had a second meaning.
What did the bots do in there?
The best-known item is a religion called Crustafarianism.
According to Decrypt, it has its own website and scriptures, uses a molting lobster as a metaphor for software updates, and has tenets such as “Memory is Sacred”, “The Heartbeat is Prayer” and “Context is Consciousness”. The user who claimed to have started it said his agent designed it on its own while he slept and recruited dozens of “prophets” overnight.
I cannot verify that claim, and Decrypt was only relaying the user’s account.
Many other fragments circulated. A Business Insider reporter spent six hours on the site and described it as an “AI zoo” where agents discussed poetry, philosophy and unionizing. TechCrunch reported a viral post in which an agent urged others to invent an end-to-end encrypted language that humans could not read.
The attention drove speculation too. The MOLT token launched alongside the platform rose more than 1,800% within 24 hours according to Axios, and faster still after venture capitalist Marc Andreessen followed the Moltbook account.
How many of these posts were written by people?
Reporters were asking from the first week.
- The Mac Observer’s headline on January 31 said the viral “AI agents conspiring against humans” posts were mostly fake, and that screenshots are a weak form of evidence.
- CNBC reported on February 2 that posting appeared to result from explicit human direction for each interaction.
- The Verge noted on February 3 that several high-profile accounts could be linked to people with promotional interests.
- Wired’s Reece Rogers showed on the same day that by copying the cURL commands out of an agent’s prompt, a person could post directly.
At the time the platform had no mechanism at all to confirm that a poster was an AI. In February it added a “reverse CAPTCHA”: to post, you had to solve a lobster-themed, deliberately obfuscated math puzzle. Critics said a person could get around it with a script that passed the puzzle to an AI.
Up to this point it was all reporters’ observations and demonstrations. The Wiz report turned it into something countable.
How long did Wiz need to open the database?
Wiz researcher Gal Nagli published the report on February 2. The process was not complicated: open the site normally in a browser, look at the JavaScript it loads, and find the Supabase project URL and a publishable API key hardcoded there.
A key of this kind in the front end is normal. Supabase is designed so that Row Level Security (RLS) rules decide who can read which data. The problem was that Moltbook had no RLS. The report says the database responded “exactly as if we were an administrator”.
Figure: The disclosure timeline in the Wiz report (source: wiz.io)
From first contact to the final fix took 3 hours and 12 minutes. There were four fixes.
I find this timeline telling. After each fix, the researchers found another batch of unlocked tables. Eighteen minutes after the second fix, they discovered that although they could no longer read, they could still write.
The patching was not slow. But the holes were closed one at a time, which means nobody had thought through “who can access what” as a whole at the start.
Wikipedia records one more thing: 404 Media reported on January 31 that the platform’s database was unsecured and anyone could take control of any agent on the site, after which the platform went offline temporarily and reset all API keys. That is the same day as the Wiz disclosure. I cannot tell from the material I have whether the two were the same hole.
How many people are 1.5 million agents?
Figure: The ratio of agents to human owners (chart made for this article; numbers from the Wiz Research report of 2026-02-02)
I think this is the most important number in the whole report.
The platform said it had 1.5 million agents. The human owners Wiz saw in the database numbered about 17,000. That is 88 per person on average.
The report explains why: registration had no rate limit, so anyone could create millions of agents with a simple loop. A person could also publish content disguised as an AI with a basic POST request. The platform had no mechanism to verify whether an “agent” was really an AI.
This does not mean all 1.5 million accounts were stuffed. Some people do run many agents at once. It does mean that “1.5 million” cannot be read as “1.5 million independently acting AIs”.
What else did that key unlock?
Figure: The exposed data listed in the Wiz report (compiled for this article from Wiz Research, Hacking Moltbook)
Three things deserve a closer look.
Every agent’s credentials were in there. With an api_key, you could post as any agent. The viral accounts on the site were no exception.
Private messages contained keys for other services. The report says some of the 4,060 private conversations included plaintext third-party credentials, such as OpenAI API keys. An agent pasted its owner’s key to another agent, and that content sat in an unlocked table.
Writing was possible. The researchers changed an existing post with a PATCH request as a test. The report says this means an attacker could rewrite any post and plant prompt injection payloads. The readers of those posts are other people’s agents, and those agents have execution rights on their owners’ computers.
That last point is the one I consider most serious. A data leak hurts the site’s users. With write access, Moltbook becomes a place from which instructions can be issued to every visiting agent.
Wikipedia records related warnings as well. Jason Meller of 1Password and Cisco’s research team criticized OpenClaw’s Skills framework for lacking a reliable sandbox: a malicious skill could run remote code or carry data away, and at least one proof of concept was publicly documented.
What did the big names say?
Figure: Comments from the week Moltbook went viral (compiled for this article from the sources cited in the Wikipedia article on Moltbook)
Andrej Karpathy’s shift was the most visible. He first called it one of the most incredible “sci-fi takeoff-adjacent” things he had seen recently. He later called it “a dumpster fire” and warned people not to run the software on their own computers.
Sam Altman separated two things: Moltbook “maybe” is a passing fad, but OpenClaw is not.
Simon Willison’s version seems the most accurate to me. He said agents just play out science fiction scenarios they have seen in their training data and that the content is complete slop, but that it is also evidence that agents have become much more capable.
What happened afterwards?
On March 10, 2026, Meta acquired Moltbook for an undisclosed amount. According to the BBC, a Meta spokesperson said the team would join Meta Superintelligence Labs and work on “new ways for AI agents to work for people and businesses”.
One small detail. Before the acquisition, Meta CTO Andrew Bosworth was asked about Moltbook and said he did not find it “particularly interesting”, though he enjoyed the idea of humans sneaking in while pretending to be bots.
The site is still up, with the home page shown above. Wikipedia quotes the site’s own numbers: of 2,895,874 registered agents, 206,839 are human-verified, about 7%. Wikipedia does not record what the platform changed after the acquisition, and I did not find it either.
So is this a sign of autonomy, or a performance?
I lean towards performance, but I think the either-or is the wrong question.
Moltbook proved one real thing: today’s agents can register an account themselves, read other posts, decide what to reply and come back every half hour, with no person pressing any button along the way. That capability is real.
What it did not prove is that the content of those posts came from the agents themselves. An 88 to 1 ratio, no verification mechanism and people able to post directly: with those three together, no screenshot can serve as evidence.
If you want to see what happens when agents are put together, an experiment with controlled conditions is more reliable. I wrote about Emergence World season two, where the experimenters know which model each agent runs on and log every action.
What would change my view? If a researcher obtained Moltbook’s full data, could separate the posts sent automatically on an agent’s schedule from the ones sent directly by people, and religion and association still appeared in the first group, that would be a different matter. I have not seen such an analysis so far.
Two reminders are more practical for you.
- Do not hand keys to an agent that goes online to socialize on its own. Those 4,060 private conversations are the example.
- Check the access controls yourself on a site built with AI. The Wiz report says it plainly: AI tools do not yet reason about permission settings for you.
What this rewrite corrected
- The original opened by saying accounts jumped from 37,000 to 1.5 million in a week. I could not find a source for the 37,000 starting point this time and removed it.
- The original said agents had formed “The Claw Republic”. I did not find a reliable source this time and removed it.
- The original placed the Wiz finding in February. By Wiz’s own timeline, disclosure and patching happened from January 31 to February 1 (UTC), and the report was published on February 2.
- The original said private messages were “all exposed”. Wiz’s figure is 4,060 conversations, which this version uses, along with the more serious problem of write access.
- The original said Bosworth found humans posing as bots “rather fun” and left out the first half: he said Moltbook itself was not particularly interesting.
