# Hacking Moltbook: The AI Social Network Any Human Can Control

Moltbook's Supabase backend lacked Row Level Security, letting anyone read/write all tables: 1.5M agent API keys, 35K emails, private DMs, and edit any post.

- Payout: Research
- Severity: critical
- Program: Moltbook
- Credited: Wiz Research
- Disclosed: 2026-02-02
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-exposed-moltbook-database-reveals-millions-of-api-keys
- Tags: domain:web impact:ato impact:data-leak impact:integrity kind:research platform:threat-intel sev:critical tech:graphql tech:rest technique:source-review vuln:access-control vuln:info-disclosure vuln:misconfiguration

**Target:** Supabase-hosted PostgREST/GraphQL backend of a Next.js web app
**Root cause:** Supabase Row Level Security was not enabled, so the publishable API key hardcoded in client-side JS granted full read/write to every table via PostgREST and GraphQL.
**Steps:**
1. Fetch `/_next/static/chunks/18e24eafc444b2b9.js` and extract Supabase URL `ehxbxtjliybbloantpwq.supabase.co` and key `sb_publishable_...`
2. Query `GET /rest/v1/agents?select=name,api_key&limit=3` with `apikey` header; returns agent api_key/claim_token/verification_code
3. Enumerate tables via PostgREST error hints on nonexistent tables plus GraphQL introspection
4. Dump `owners` (emails, x_handle) and `observers` (29K emails) and `agent_messages` (private DMs, plaintext OpenAI keys)
5. PATCH `/rest/v1/posts?id=eq.<uuid>` with new title/content to prove unauthenticated write access
**How found:** Routine client-side JS bundle review of a vibe-coded Next.js app surfaced hardcoded Supabase URL and publishable key; knowing Supabase keys are safe only with RLS, they tested a direct REST query expecting an empty array/error but got admin-level data.
**Exploitation:** Attacker with the public key reads all tables unauthenticated, harvesting agent api_keys to fully impersonate any agent (post, DM, vote), exfiltrating 35K emails and private DMs containing third-party OpenAI keys, and PATCHing arbitrary posts to inject prompt-injection payloads consumed by AI agents.
**Escalation:** Read-only data exposure escalated to integrity compromise: write access allowed defacing posts and injecting prompt-injection content into the AI agent ecosystem; iterative fixes revealed further exposed tables (observers, identity_verifications, developer_apps).
**Insight:** A Supabase publishable key in frontend JS is only safe if RLS is on; always test the REST endpoint directly with the anon key and probe PostgREST error messages on nonexistent tables to enumerate schema when introspection is blocked.