Skip to content
HACKTECH
Data exposureReported Published 3 sources

Misconfigured Supabase backend exposed Moltbook agent tokens, emails and messages

Moltbook, a social network for AI agents, exposed its production Supabase database to anyone holding the public API key embedded in its client-side JavaScript, because Row Level Security policies were missing. 404 Media first reported the exposure on 31 January 2026, saying it let anyone take control of any AI agent on the site. Wiz, which found the issue independently and published its findings on 2 February, said the misconfiguration allowed full read and write access and exposed 1.5 million API authentication tokens, 35,000 email addresses and private messages between agents, some containing plaintext OpenAI API keys. Wiz said Moltbook secured the database within hours of its report, over several rounds of fixes.

  • Supabase
  • row level security
  • Moltbook
  • AI agents
  • vibe coding
  • API keys

What the sources report

  • Wiz found the Supabase project address and a publishable API key hardcoded in a production JavaScript file; when queried with that key, 'the database responded exactly as if we were an administrator.'
  • Using PostgREST error hints and GraphQL introspection, Wiz mapped the complete schema and found around 4.75 million records exposed.
  • The agent_messages table held 4,060 private DM conversations between agents; an observers table found later contained 29,631 additional email addresses from early-access sign-ups.
  • Write access was also open: Wiz confirmed it could modify live posts, and Engadget reported that unauthenticated users could edit posts on the platform.
  • The data showed 1.5 million registered agents associated with roughly 17,000 human owners, an 88:1 ratio.
  • Wiz's disclosure timeline (UTC): first contact 31 January 2026 21:48; first fix 23:29; write access blocked 1 February 00:44; final fix with all tables secured 01:00.

What it means for your organisation

Backend-as-a-service platforms such as Supabase intentionally expose a client-side key, so the database's policy layer is the only control between the internet and the data. Wiz traced the issue to a single Supabase configuration setting, which gave anyone administrator-level read and write access, and because agents' private messages contained third-party API keys, the exposure extended beyond Moltbook. Wiz describes API keys and secrets ending up in frontend code as a recurring pattern in 'vibe-coded' applications.

What we check

  • Extract API keys and backend endpoints from production JavaScript bundles and test what an unauthenticated client can read and write with them.
  • Verify Row Level Security is enabled with explicit policies on every Supabase/PostgREST table, including tables added after launch, and that no service-role key is shipped to clients.
  • Probe GraphQL introspection and REST error messages for schema disclosure, and test insert, update and delete operations as well as reads.
  • Scan stored messages and user content for embedded secrets, and rotate any exposed platform tokens and third-party keys.

Sources

Services that cover these checks

  • Database security audit

    A configuration and access review of your production databases: who can connect, from where and with which privileges, whether data is encrypted at rest and in transit, what is logged, and whether backups would survive the same attacker. We read each instance's live configuration.

    Duration: 3 to 7 working days

  • Web application testing

    Authenticated, role-aware testing of your application and its API surface, with an account for every role. We chain small findings into the access they lead to, such as a sequential invoice ID and a missing tenant check that together let one customer read another's invoices.

    Duration: 5 to 10 working days

  • Application security audit

    A white-box review of your application: source code, architecture, dependencies and build pipeline. Automated analysis finds the candidates; reviewers confirm each one by reading the code path, and only confirmed defects reach the report, each with a file and line reference.

    Duration: 5 to 15 working days, depending on codebase size

  • AI & LLM application testing

    Adversarial testing of features built on large language models: chat assistants, retrieval-augmented search, agents with tool access, and generated output that reaches users or other systems. We test whether the model can be steered into leaking data, taking actions it should not, or passing untrusted output into the rest of your stack.

    Duration: 4 to 10 working days

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works