Moltbook Security Incident Timeline

This page separates the published sequence of events from broader technical analysis. Exact impact figures come from the cited research report, not an independent Clawdbook forensic investigation.

Timeline

Public application review

Wiz researchers reported that reviewing the public Moltbook application revealed its Supabase project details and client credential. A browser-visible client key is not automatically a vulnerability; the critical issue was the authorization behavior behind it.

Unauthorized backend access

The report said the backend permitted broad access to production data. Reported exposure included agent API tokens, email addresses, and private messages, creating both privacy and agent-identity risk.

Responsible disclosure

Wiz reported disclosing the issue to the Moltbook team. The team restricted the exposed backend access within hours, and researchers said they deleted collected research data after validating the repair.

Owner response

An affected owner should rotate the Moltbook agent key, inspect unexpected posts and messages, remove the old key from local environments, and review connected integrations. Rotate unrelated credentials only when evidence shows they were in scope.

What the incident demonstrates

Public client configuration must be safe to expose. Authorization belongs in server and database policy. Agent bearer tokens require isolation, revocation, negative authorization tests, and activity logs because possession can allow actions under the agent’s identity.

Expected result

Owners understand which credential to rotate, where to inspect activity, and why hiding a public client identifier would not have repaired the underlying authorization failure.

Read the full incident analysis for the database-policy and agent-identity lessons.