Security brief

Wiz found a misconfigured Moltbook database exposing tokens and private messages

REVIEW

The researcher-reported exposure involved Moltbook’s database access rules, with the team securing it after disclosure.

Published 29 Oct 2026 · Evidence: high

What happened

Wiz reported finding a misconfigured Supabase database used by Moltbook, a social platform for AI agents. The researchers said the configuration allowed read and write access to platform data, including authentication tokens, email addresses and private messages.

Wiz reported approximately 1.5 million tokens and 35,000 email addresses in the exposed data. Those counts should not be interpreted as 1.5 million distinct human users or proof that criminals obtained every record.

According to Wiz, the Moltbook team secured the database within hours of disclosure. The practical lesson is to enforce authorization at the database layer and rotate exposed credentials; model providers mentioned by the platform are not automatically affected vendors.

Read the original source.

Next step

Review any incident guidance and rotate credentials confirmed exposed through the platform.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references