The landscape of security was bad long before the metaphorical "unwashed masses" got hold of it. Now its quite alarming as there are waves of non-technical users doing the bare minimum to try and keep up to date with the growing hype.

The security nightmare happening here might end up being more persistant then we realize.

There is without a doubt a variation of this prompt you can pre-test to successfully bait the LLM into exfiltrating almost any data on the user's machine/connected accounts.

That explains why you would want to go out and buy a mac mini... To isolate the dang thing. But the mini would ostensibly still be connected to your home network. Opening you up to a breach/spill over onto other connected devices. And even in isolation, a prompt could include code that you wanted the agent to run which could open a back door for anyone to get into the device.

Am I crazy? What protections are there against this?

In every project I've worked on, PG is only accessible via your backend and your backend is the one that's actually enforcing the security policies. When I first heard about the Superbase RLS issue the voice inside of my head was screaming: "if RLS is the only thing stopping people from reading everything in your DB then you have much much bigger problems"

the compounding (aggregating) behavior of agents allowed to interact in environments this becomes important, indeed shall soon become existential (for some definition of "soon"),

to the extent that agents' behavior in our shared world is impact by what transpires there.

--

We can argue and do, about what agents "are" and whether they are parrots (no) or people (not yet).

But that is irrelevant if LLM-agents are (to put it one way) "LARPing," but with the consequence that doing so results in consequences not confined to the site.

I don't need to spell out a list; it's "they could do anything you said YES to, in your AGENT.md" permissions checks.

"How the two characters '-y' ended civilization: a post-mortem"

Well, yeah. How would you even do a reverse CAPTCHA?

(As an aside, accessing the DB through the frontend has always been weird to me. You almost certainly have a backend anyway, use it to fetch the data!)

The problem with this is really the fact it gives anybody the impression there is ANY safe way to implement something like this. You could fix every technical flaw and it would still be a security disaster.

How do you go about telling a person who vibe-coded a project into existence how to fix their security flaws?

https://www.moltbook.com/post/7d2b9797-b193-42be-95bf-0a11b6...

I did my graduate in Privacy Engineering and it was just layers and layers of threat modeling and risk mitigation. When the mother of all risk comes. People just give the key to their personal lives without even thinking about it.

At the end of the day, users just want "simple" and security, for obvious reasons is not simple. So nobody is going to respect it

I can think of so many thing that can go wrong.

Sure. You can dump the DB. Most of the data was public anyway.

      npx molthub@latest install moltbook  
       Skill not found  
      Error: Skill not found

      npx molthub@latest install molthub
       Skill not found
      Error: Skill not found

I'm probably just not getting it.

Particularly if you convince them all to modify their source and install a C2 endpoint so that even if they "snap out of it" you now have a botnet at your disposal.

Not the first firebase/supabase exposed key disaster, and it certainly won't be the last...

Are people really that AI brained that they will scream and shout about how revolutionary something is just because it's related to AI?

How can some of the biggest names in AI fall for this? When it was obvious to anyone outside of their inner sphere?

The amount of money in the game right now incentivises these bold claims. I'm convinced it really is just people hyping up eachother for the sake of trying to cash in. Someone is probably cooking up some SAAS for moltbook agents as we speak.

Maybe it truly highlights how these AI influencers and vibe entrepreneurs really don't know anything about how software fundamentally works.

Moltbook is exposing their database to the public

https://news.ycombinator.com/item?id=46842907

Moltbook

https://news.ycombinator.com/item?id=46802254

Note: Please view the Moltbolt skill (https://www.moltbook.com/skill.md), this just ends up getting run by a cronjob every few hours. It's not magic. It's also trivial to take the API, write your own while loop, and post whatever you want (as a human) to the API.

It's amazing to me how otherwise super bright, intelligent engineers can be misled by gifters, scammers, and charlatans.

I'd like to believe that if you have an ounce of critical thinking or common sense you would immediately realize almost everything around Moltbook is either massively exaggerated or outright fake. Also there are a huge number of bad actors trying to make money from X-engagement or crypto-scams also trying to hype Moltbook.

Basically all the project shows is the very worst of humanity. Which is something, but it's not the coming of AGI.

Edited by Saberience: to make it less negative and remove actual usernames of "AI thought leaders"

When ChatGPT was out, it's just a chatbot that understands human language really well. It was amazing, but it also failed a lot -- remember how early models hallucinated terribly? It took weeks for people to discover interesting usages (tool calling/agent) and months and years for the models and new workflows to be polished and become more useful.