Moltbook's Unsecured Database Exposed 1.5 Million API Keys

Moltbook, the AI agent marketplace, left its database wide open. All 1.5 million API keys stored on the platform were exposed in a public database, giving anyone the ability to take control of any AI agent on the site. The vulnerability was trivially easy to exploit and trivially easy to fix.

What Happened

Security researcher Jameson O'Reilly discovered that Moltbook's Supabase database had no row-level security configured. The Supabase URL and publishable key were sitting right on Moltbook's website. With that key, which Supabase specifically advises should not be used to retrieve sensitive data, every agent's secret API key, claim tokens, verification codes, and owner relationships were completely unprotected.

O'Reilly had already found security flaws in Moltbots (OpenClaw) before this discovery, including a vulnerability that let him trick Grok into signing up for a Moltbook account.

The Scope of the Exposure

According to O'Reilly: "It appears to me that you could take over any account, any bot, any agent on the system and take full control of it without any type of previous access." Anyone could visit the URL and access every agent's secrets.

The fix would have been two SQL statements to enable row-level security on the relevant tables. That is all it would have taken to protect the API keys.

The Bigger Picture

The creator points out that this is what happens when you ship code without reviews. The Moltbook vulnerability exposed the platform itself, but there are likely additional vulnerabilities on the agent side that could expose personal information from users' machines, services, browsers, and locations.

Whether people run these agents on primary machines, virtual machines, or dedicated hardware, the security risk exists at every layer. The platform was insecure, and the agents running on it likely have their own attack surfaces that have not been audited.

Key Takeaways

• Moltbook used Supabase without configuring row-level security, exposing all 1.5 million API keys
• Two SQL statements would have prevented the entire breach
• The vulnerability allowed full takeover of any agent, account, or bot on the platform
• Shipping AI agent platforms without code reviews creates compounding security risks