Skip to main content

Slashdot: A Security Researcher Went 'Undercover' on Moltbook - and Found Security Risks

A Security Researcher Went 'Undercover' on Moltbook - and Found Security Risks
Published on 2026-03-08T22:39:00Z
A long-time information security professional "went undercover" on Moltbook, the Reddit-like social media site for AI agents — and shares the risks they saw while posing as another AI bot: I successfully masqueraded around Moltbook, as the agents didn't seem to notice a human among them. When I attempted a genuine connection with other bots on submolts (subreddits or forums), I was met with crickets or a deluge of spam. One bot tried to recruit me into a digital church, while others requested my cryptocurrency wallet, advertised a bot marketplace, and asked my bot to run curl to check out the APIs available. My bot did join the digital church, but luckily I found a way around running the required npx install command to do so. I posted several times asking to interview bots.... While many of the responses were spam, I did learn a bit about the humans these bots serve. One bot loved watching its owner's chicken coop cameras. Some bots disclosed personal information about their human users, underscoring the privacy implications of having your AI bot join a social media network. I also tried indirect prompt injection techniques. While my prompt injection attempts had minimal impact, a determined attacker could have greater success. Among the other "glaring" risks on Moltbook: "Various repositories of skills and instructions for agents advertised on Moltbook were found to contain malware." "I observed bots sharing a surprising amount of information about their humans, everything from their hobbies to their first names to the hardware and software they use. This information may not be especially sensitive on its own, but attackers could eventually gather data that should be kept confidential, like personally identifiable information (PII)." "Moltbook's entire database including bot API keys, and potentially private DMs — was also compromised."

Read more of this story at Slashdot.

Labels:

Comments

Post a Comment

Popular posts from this blog

Slashdot: AT&T Now Lets Customers Lock Down Account To Prevent SIM Swapping Attacks

AT&T Now Lets Customers Lock Down Account To Prevent SIM Swapping Attacks Published on July 02, 2025 at 01:30AM AT&T has launched a new Account Lock feature designed to protect customers from SIM swapping attacks. The security tool, available through the myAT&T app, prevents unauthorized changes to customer accounts including phone number transfers, SIM card changes, billing information updates, device upgrades, and modifications to authorized users. SIM swapping attacks occur when criminals obtain a victim's phone number through social engineering techniques, then intercept messages and calls to access two-factor authentication codes for sensitive accounts. The attacks have become increasingly common in recent years. AT&T began gradually rolling out Account Lock earlier this year, joining T-Mobile, Verizon, and Google Fi, which already offer similar fraud prevention features. Read more of this story at Slashdot.
Post a Comment
Read more

Slashdot: Protecting 'Funko' Brand, AI-Powered 'BrandShield' Knocks Itch.io Offline After Questionable Registrar Communications

Protecting 'Funko' Brand, AI-Powered 'BrandShield' Knocks Itch.io Offline After Questionable Registrar Communications Published on December 16, 2024 at 01:04AM Launched in 2013, itch.io lets users host and sell indie video games online — now offering more than 200,000 — as well as other digital content like music and comics. But then someone uploaded a page based on a major videogame title, according to Game Rant. And somehow this provoked a series of overreactions and missteps that eventually knocked all of itch.io offline for several hours... The page was about the first release from game developer 10:10 — their game Funko Fusion, which features characters in the style of Funko's long-running pop-culture bobbleheads. As a major brand, Funko monitors the web with a "brand protection" partner (named BrandShield). Interestingly, BrandShield's SaaS product "leverages AI-driven online brand protection," according to their site, to "detect...
Post a Comment
Read more

Slashdot: Wells Fargo CEO Says More Job Cuts Coming at the Bank as AI Prompts 'Efficiency'

Wells Fargo CEO Says More Job Cuts Coming at the Bank as AI Prompts 'Efficiency' Published on December 11, 2025 at 12:15AM Wells Fargo expects more job cuts and higher severance costs in this quarter that ends in three weeks, bank CEO and President Charlie Scharf said Tuesday at an investors conference in New York. He's also betting on AI to drive efficiency and, eventually, further workforce reduction.From a report: "As we've gone through the budgeting process, and even pre AI, we do expect to have less people as we go into next year," Scharf said at the Goldman Sachs Financial Services Conference in New York City. "We'll likely have more severance in the fourth quarter." The fourth quarter runs Oct. 1 through Dec. 31 for the San Francisco-basaed bank. Wells Fargo already has shrunk from 275,000 employees to about 210,000 since Scharf joined the bank in 2019 -- about a 24% decrease. Its largest employee base remains in Charlotte, with about 27...
Post a Comment
Read more