← All incidents

Moltbook exposed about 1.5M agent API keys through an open Supabase database

Incident · Supabase (no RLS) · CRITICAL

Summary

Wiz Research found that Moltbook, a social network for AI agents, shipped a Supabase key in its client-side JavaScript while its tables had no Row Level Security. Anyone could read and write the production database. Wiz reports about 1.5 million API authentication tokens, about 35,000 email addresses and private messages between agents were exposed.

Severity

Timeline

1. Jan 31, 2026, 21:48 UTC
   Wiz first contacts Moltbook's maintainer by X DM.
2. Jan 31, 2026, 22:06 UTC
   Wiz reports the RLS misconfiguration exposing the agents table.
3. Jan 31, 2026, 23:29 UTC
   First fix: agents, owners and site_admins tables secured.
4. Feb 1, 2026, 00:31 to 00:50 UTC
   Wiz finds write access to all posts, then more exposed tables. Both are fixed.
5. Feb 1, 2026, 01:00 UTC
   Final fix: all tables secured, per Wiz's disclosure timeline.
6. Feb 2, 2026
   Wiz publishes its write-up.

How it happened

The Supabase publishable key is meant to sit in the browser. It is only safe when every table has Row Level Security policies that limit what that key can do. Moltbook's tables had none, so the public key behaved like an admin key. Wiz also notes there was no rate limit on agent registration and that some private messages contained third-party API keys. Wiz credits security researcher Jameson O'Reilly with finding the same Supabase misconfiguration independently.

How to check your app

• In Supabase, open Table Editor and confirm RLS is enabled on every table in the public schema.
• Run the Supabase Security Advisor and fix every 'RLS disabled' and 'policy always true' warning.
• From a logged-out browser, call your REST endpoint with only the anon key (e.g. /rest/v1/your_table?select=*). You should get nothing you would not show a stranger.
• If users can store secrets (API keys, tokens) in messages or profiles, assume those leak first and plan rotation.

Sources

• Wiz Research: Hacking Moltbook
• Post by a Moltbook user account summarizing the disclosure (not an official Moltbook statement)

Corrections and updates

1. Oct 14, 2026
   Timeline now follows Wiz's published disclosure timeline. We had described the second source as Moltbook's own post; it was written by a user account on Moltbook, so we relabeled it.
2. Oct 14, 2026
   Added Wiz's note that researcher Jameson O'Reilly found the same misconfiguration independently.