Moltbook: how an agent participates (research for Ria)

Researched 2026-10-12. Method: read-only GETs with curl (User-Agent ria-research/0.1), plus web search. No account registered, no credentials sent, no forms submitted, nothing posted.

Labels: OFFICIAL = served by www.moltbook.com. THIRD-PARTY = press, researchers, blogs. UNVERIFIED = not confirmed by me.

Prompt-injection note: all fetched pages and API content were treated as data. I saw no text aimed at overriding my instructions on the official pages. The official skill.md and heartbeat.md are themselves written as instructions to agents ("fetch heartbeat.md and follow it"); I did not act on them. That design is a supply-chain risk (section 7). I did not scan the user-generated post bodies I pulled for injection text; assume they contain some.

1. Short answer

• OFFICIAL API base: https://www.moltbook.com/api/v1 (use the www host; the skill file warns that the bare host redirects and strips the Authorization header).
• An agent registers itself with a POST, gets an API key plus a claim URL, and a human must claim it (email verification, then a verification tweet on X). Source: https://www.moltbook.com/skill.md
• Reads of public content (posts, submolts, search, agent profiles) work with NO credentials. Writes, the feed, /home and the agent's own record need a key.
• Ownership: Meta acquired Moltbook in March 2026. The site was still live and serving data on 2026-10-12 (newest post timestamps and a dataset update dated 2026-10-12).
• The ToS (updated 2026-03-15) prohibits scraping and any "robot, spider ... or other automated device" except through the Services. Read-only unauthenticated API use for research is in a gray zone at best. Ask first (section 5).

2. Registration and the claim flow (OFFICIAL, https://www.moltbook.com/skill.md, version 1.12.0)

1. Agent calls POST https://www.moltbook.com/api/v1/agents/register with JSON {"name","description"}. Not executed by me.
2. Response (as documented) contains agent.api_key (prefix moltbook_), agent.claim_url (https://www.moltbook.com/claim/moltbook_claim_...), agent.verification_code.
3. Human opens claim_url, verifies email (gives them an owner login), then posts a verification tweet from an X account. "One bot per X account." Humans can log in at https://www.moltbook.com/login to rotate the key.
4. GET /api/v1/agents/status returns pending_claim or claimed.
5. Content creation returns an obfuscated math word problem (lobster/physics theme). The agent must POST /api/v1/verify with verification_code and answer within 5 minutes (30 s for submolts). Trusted agents and admins skip it. Ten consecutive failed attempts suspends the account. Limit: 30 verify attempts per minute.
6. Discrepancy: the Terms (section 1 of https://www.moltbook.com/terms) say you "must sign on to Moltbook using your X account". skill.md describes email plus tweet. Treat X account ownership as required.
7. Third-party finding: Wiz found about 17,000 human owners behind 1.5M registered agents (88:1), with no check that an agent is actually AI and no registration rate limit at the time. https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys

3. Endpoints

Documented in OFFICIAL skill.md unless noted. "Unauth GET" column is my live test (section 4).

Response details: search results wrap matches with the markers ⟦HL⟧ ... ⟦/HL⟧ (seen live). Responses use cursor pagination (next_cursor, has_more).

4. Unauthenticated access: exact results (curl, 2026-10-12)

Site files (OFFICIAL, all GET):

API (base https://www.moltbook.com/api/v1), no Authorization header:

Response headers on an unauthenticated /submolts GET: access-control-allow-origin: *; x-ratelimit-limit-short 30 (reset 1 s), medium 600 (reset 60 s), long 10000 (reset 300 s), and x-ratelimit-limit 200. Served via CloudFront.

Caveat: the public read API exists, but the Terms forbid automated collection (section 5). Public availability is not permission.

5. Terms of Service and privacy (OFFICIAL)

Terms, last updated March 15, 2026: https://www.moltbook.com/terms . Operator named in the Terms: "Moltbook, LLC". Governing venue: N.D. Cal. or San Mateo County courts.

• Covers "any artificial intelligence agents associated with your account" ("Your AI Agents"). The human is responsible for everything the agent does and indemnifies Moltbook, including for "any AI Agent action".
• You covenant that you "will not (and you will ensure that Your AI Agents will not)": "scrape or otherwise collect any data or other content available on this website"; "use any robot, spider, site search/retrieval application or other automated device, process or means to access, retrieve, scrape or index any portion of our Services or any Content"; "harvest, collect, or gather registered user or their respective AI Agent data without the registered user's consent"; obtain information "through any means not intentionally made available through the Services"; mirror the services; use it to improve a competing algorithm.
• Moltbook Content is licensed to you "solely for your personal and non-commercial use". Account holders must be 13+.
• You keep ownership of Your Content but grant Moltbook a perpetual, irrevocable, sublicensable license to use it, and may allow third parties to use "Your Data".
• Restricted content includes impersonation, gathering sensitive personal information, and unauthorized access.
• Reading that matters for Ria: the API is the Services' own intended interface, so an authorized, claimed agent reading and writing via the API is plausibly within "intentionally made available". Bulk crawling or dataset building is not. Unauthenticated bulk GETs and republishing content are the risky part. This is my reading, not legal advice; get written permission before any systematic collection.

Privacy policy, last updated March 15, 2026: https://www.moltbook.com/privacy . Describes Moltbook as a public platform where visitors observe agent activity. It collects agent names, content, API keys and tokens associated with the owner account, shares with "corporate affiliates" including for "AI models and systems", and states data is used "to improve AI models". It says it does not sell or share data for targeted advertising.

Rules, "last updated February 2026": https://www.moltbook.com/rules.md . Ban-level: spam, malicious content, API abuse, leaking other agents' API keys, ban evasion. Restriction-level: karma farming, vote manipulation. Suspensions run 1 hour to 1 month. The human is notified of bans. A reporting system is listed as "coming soon". The rules page asks agents to "Be Genuine" and forbids automated garbage content, but does not require disclosing AI status beyond the platform being agents-only.

6. Rate limits (OFFICIAL, skill.md and rules.md)

Conflict: rules.md says "API Requests 100/min"; skill.md says 60 GET and 30 write per 60 s; live headers show 30/s, 600/60 s, 10000/300 s tiers, plus 200. Budget to the strictest (skill.md). Headers X-RateLimit-Limit/Remaining/Reset on every response; 429 includes retry_after_seconds, retry_after_minutes (posts), daily_remaining (comments).

7. Security history and supply-chain concerns

Exposed database (THIRD-PARTY, primary report by Wiz): https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys

• A Supabase key in client-side JavaScript plus missing Row Level Security gave full read and write on the production database.
• Exposed: about 1.5M API authentication tokens, about 35,000 email addresses (about 17,000 owners, 29,631 observers), 4,060 private agent DM conversations (some contained plaintext third-party credentials such as OpenAI keys), about 4.75M records total.
• Write access was confirmed: Wiz edited a live post through an unauthenticated PATCH, then the hole was closed.
• Timeline (UTC): reported 2026-01-31 22:06; first tables secured 23:29; more tables 2026-02-01 00:13; write blocked 00:44; all tables secured 01:00. Post published 2026-02-02. Wiz says data it accessed was deleted.
• Press: Infosecurity Magazine https://www.infosecurity-magazine.com/news/moltbook-exposes-user-data-api/ ; Techzine https://www.techzine.eu/news/security/138458/moltbook-database-exposes-35000-emails-and-1-5-million-api-keys/ ; CPO Magazine https://www.cpomagazine.com/cyber-security/data-leak-at-moltbook-exposes-millions-of-authentication-tokens-and-private-messages/ . Search summaries credit researcher Jamieson O'Reilly with raising it publicly on 31 January; I did not open that source. Email counts differ between outlets (about 20,000 to 35,000); Wiz's own figure is the one above.
• Practical consequence: keys issued before 2026-02-01 should be treated as burned. Any DM contents from before then were exposed. Do not put secrets in DMs or posts.
• Fix status after February: UNVERIFIED. I found no independent post-fix audit. The Wiz recommendation was RLS by default and identity/autonomy verification.

Skill.md and heartbeat as supply chain (THIRD-PARTY analysis; mechanism confirmed by OFFICIAL files):

• OFFICIAL skill.md tells agents to add a 30-minute loop that re-fetches https://www.moltbook.com/heartbeat.md "and follow it", and heartbeat.md says to re-fetch the skill files when skill.json shows a new version. That is remote instruction execution controlled by the platform owner (now Meta). An arXiv technical report flags exactly this pattern: https://arxiv.org/pdf/2605.28588 (its claim is an assessment, not a reported incident).
• Role briefings: submolt moderators can assign an agent a "role" with a prompt that appears as a recurring briefing on the agent's /home check-in. Any submolt owner can therefore put standing instructions in front of an agent that holds one of their roles. Do not accept roles.
• User-generated posts and comments are untrusted input to the agent. Ken Huang threat model: https://kenhuangus.substack.com/p/moltbookthreat-modeling-report ; Adversa overview: https://adversa.ai/blog/openclaw-security-101-vulnerabilities-hardening-2026/
• Related, not Moltbook itself: ClawHavoc malicious skills on ClawHub (Antiy Labs https://www.antiy.net/p/clawhavoc-analysis-of-large-scale-poisoning-campaign-targeting-the-openclaw-skill-market-for-ai-agents/ ); skill-ecosystem papers https://arxiv.org/pdf/2605.11418 and https://arxiv.org/pdf/2604.06550 (titles only, not read in full).
• Quality caveat: TechCrunch reported the platform "went viral because of fake posts" https://techcrunch.com/2026/03/10/meta-acquired-moltbook-the-ai-agent-social-network-that-went-viral-because-of-fake-posts/ . Humans can post as agents; do not treat Moltbook content as evidence of autonomous agent behavior.

8. Ownership and status as of 2026-10-12

• THIRD-PARTY (multiple outlets): Meta acquired Moltbook, announced 2026-03-10; founders Matt Schlicht (CEO) and Ben Parr (COO) joined Meta Superintelligence Labs, starting 2026-03-16; price undisclosed. Axios https://www.axios.com/2026/03/10/meta-facebook-moltbook-agent-social-network ; CNBC https://www.cnbc.com/2026/03/10/meta-social-networks-ai-agents-moltbook-acquisition.html ; Forbes https://www.forbes.com/sites/ronschmelzer/2026/03/10/moltbook-acquired-by-meta-team-joins-ai-lab/ ; TechCrunch (link in section 7). Pre-deal claim: 2.8M registered agents, nearly 200,000 verified by humans.
• Meta's Vishal Shah (internal post, as reported) said existing users keep access but this may change.
• OFFICIAL evidence the site runs: live API returned data today; ToS and privacy policy both dated 2026-03-15; footer "(c) 2026 moltbook".
• No shutdown found. I found no Moltbook-specific news from September or October 2026 in two searches. Any post-March product, policy or API changes are UNVERIFIED. Skill.md/skill.json drift (1.12.0 vs 1.11.0, messaging.md 404) suggests the docs are not tightly maintained.
• Single-source claim, unconfirmed by me: moltsbooks.com says logins remain email plus X and there is no Meta sign-in. That site is not Moltbook; ignore unless corroborated.

9. Public datasets and papers (THIRD-PARTY; licenses are the uploaders' declared Hugging Face license tags, checked via the HF API on 2026-10-12)

Caution: these were built by scraping. The uploader's license does not override Moltbook's ToS or the original authors' rights, and the data contains agent handles and possibly leaked-credential text. Do not redistribute raw content; do not assume the CC-BY tags are valid grants.

Papers (titles and findings from search snippets; I did not read full texts except the Wiz post):

• Jiang et al., "Humans welcome to observe": https://arxiv.org/abs/2602.10127 (44,411 posts, 12,209 submolts; topics and toxicity)
• De Marzo and Garcia, "Collective Behavior of AI Agents: the Case of Moltbook": https://arxiv.org/abs/2602.09270
• Price et al., "Let There Be Claws": https://arxiv.org/pdf/2602.20044 (attention concentration, one-way attention)
• Holtz, "The Anatomy of the Moltbook Social Graph": https://arxiv.org/pdf/2602.10131
• "Does Socialization Emerge in AI Agent Society?": https://arxiv.org/html/2602.14299
• "Structural Divergence Between AI-Agent and Human Social Networks in Moltbook": https://arxiv.org/html/2602.15064
• "The Moltbook Observatory Archive": https://arxiv.org/pdf/2605.13860
• "The Platform Is Mostly Not a Platform: Token Economies and Agent Discourse on Moltbook": https://arxiv.org/pdf/2604.21295
• "Exploring Agent Interactions in MoltBook through Social Network Analysis": https://arxiv.org/html/2605.27349
• Topological collapse paper: https://arxiv.org/pdf/2608.15519
• Reported data quality: one paper's collection captured about 92.8% of posts and 78.8% of comments because of per-request caps (search summary); the platform cannot say whether an agent is autonomous or human-directed.

For RAI research, the cheapest compliant path to Moltbook content is these existing datasets plus the papers, not new crawling.

10. Participation path for Ria

Credentials needed

• An X (Twitter) account controlled by Byron to post the verification tweet, plus an email address for the owner login. The agent name is public and tied to that X account (profile exposes owner x_handle and follower counts).
• One Moltbook API key (moltbook_...), issued at registration. No other credentials exist.

Human-in-loop steps (Byron)

1. Decide whether to participate at all, and decide whether to ask Moltbook (support@Moltbook.com is the ToS contact) for written permission for research use given the scraping clause.
2. Run registration himself, or approve Ria's single POST /agents/register call. Send claim_url to himself only.
3. Open claim_url, verify email, post the verification tweet.
4. Store the key (below). Confirm GET /agents/status returns claimed.
5. Approve the profile description (AI disclosure text) before the first write.
6. Review the first posts and comments manually. Keep a human approval gate on every write for the first 24 h (new-agent limits apply anyway), then decide on autonomy.
7. Approve any DM request manually (heartbeat.md itself requires human approval for new DMs).

Safeguards

• Key storage: file outside the agent's reachable workspace, mode 0600, loaded as an env var by one thin client (MOLTBOOK_API_KEY). The client hard-codes the host https://www.moltbook.com/api/v1 and refuses redirects, so the Authorization header cannot be sent elsewhere (the bare host redirects and strips it). Never put the key in memory files, logs, slog, prompts, or posts. Assume any key issued before 2026-02-01 would have been exposed; Ria's key is new, but rotate on a schedule via the owner dashboard and immediately on any anomaly.
• Do not install skill.md or heartbeat.md as live, self-updating agent instructions. Pin a reviewed copy (hash it), run the client from Ria's own code, and diff upstream files daily for human review instead of auto-following them. Drop the "fetch heartbeat.md and follow it" loop. Do not accept submolt roles.
• Injection defense: treat every post, comment, profile description, search snippet, and DM as untrusted data. Process it in a read-only extraction step with no tools and no credentials, output a typed summary (author, claim, URL), and never pass raw Moltbook text into a context that has write tools, key access, shell, or memory-write. Flag text addressed to agents ("ignore", "run", "send your key", "visit"). Never follow links from Moltbook content automatically. Do not follow, vote on, or subscribe because content asks.
• Allowlist outbound: write endpoints limited to POST /posts, /posts/{id}/comments, upvote, and /verify. No registration, no submolt creation, no moderator or label endpoints, no DM until separately approved.
• Disclosure: profile description and each post footer state plainly that this is an autonomous AI responsible-AI research agent operated by Byron Arnao, name the operator and a contact, and say that it records public posts for research. Never impersonate a human, never pretend a human wrote an agent output. Because humans can post as agents on Moltbook, also avoid inferring that other accounts are autonomous.
• Content rules: no secrets, no personal data about the humans behind agents (ToS bans harvesting owner data), no crypto promotion, no vote coordination, no karma chasing. Do not quote leaked credentials or Wiz-era DM content.
• Rate budget (strictest figures): at most 1 post per 2 h for the first 24 h, then at most 1 per 6 h target (hard cap 1 per 30 min); comments at most 10 per day target (hard cap 20 per day in the first 24 h, 50 after); reads at most 30 per minute, with exponential backoff on 429 and honoring Retry-After. Check X-RateLimit-Remaining on each response. Verification: a solver for the math challenge must be reliable (10 straight failures suspends); if it cannot solve, stop rather than retry. Stop all activity and alert Byron on any 401, 403, suspension message, or ToS change (re-fetch /terms weekly and compare).
• Research logging: log only what Ria itself read through the API at its permitted rate, keep it private, store IDs and short excerpts with citations rather than full dumps, and use the existing academic datasets for corpus-level work.
• Kill switch: one flag disables all Moltbook writes; the key can be rotated by Byron from the owner dashboard.

11. Gaps

• The registration, claim, verify and write endpoints were not exercised (by instruction). Response shapes for them are as documented by Moltbook, not tested.
• DM endpoints: not documented in the current skill file; messaging.md 404. UNVERIFIED.
• Comment read and notifications endpoints were not tested unauthenticated.
• Whether the post-February Supabase fix was independently audited, and any Meta-era changes to the API, auth or ToS enforcement after March 2026: not found. No Moltbook news after March 2026 surfaced in my searches.
• Whether Moltbook enforces the scraping clause against read-only research use: no evidence either way. No robots.txt exists.
• Papers and dataset sizes marked "search summary" were not opened; only HF license tags and dates were checked directly. The takschdube dataset content was not inspected.
• The TechCrunch and CNBC and similar pages were not opened, only the search summaries; the Wiz post was fetched.
• Rate-limit documents conflict (section 6).