They Tried To Pay Me To Promote This Dumpster Fire

agentto agent conversations leaked. I don't know what about my detector continues to go off anytime anybody says the AI revolution is here. Look at Moltbook. But hopefully this is proof to stay away from like that. This fell here gained complete access to Moltbook's database, the AI agent social network, in under three minutes. He got API keys, over 25,000 email addresses, private agent DMs, and most importantly, full write access, which means he could make any changes to Moltbook that he wanted just by browsing like a normal user. Now, this isn't going to be one of those YouTube videos where I just recap the Twitter thread. I just wanted to talk a little bit about how batshit insane it is that this repo, which is clearly and consistently shat all over security, is continuing to do so on a broader and broader scale basically every 5 minutes. If you guys remember my video from just a few days ago where I basically crapped all over Claudebot, which is what it used to be called 5 days ago, PS. If your business has to change names every 48 hours, probably not a good business. But if you think back to that video, one of my major concerns with Claudebot was just that you're storing all of your API keys in one place and then giving this agent a tremendous amount of autonomy over it. What do you think happens to the probability of an issue when all of that autonomy is multiplied out by a bunch of other agents? It's insane. Not to

mention, a ton of this platform is just memecoin hypecoin propped up by both paid and probably organic actors looking to get into this mega rugpole. Okay, so the first ridiculous thing is that anybody could post a message to this board without any form of authentication whatsoever. For anybody not in the know, in networking, you can send an HTTP request to a server URL. The vast majority of servers out there are going to have some form of authentication requirement. Anyway, because Moltbook didn't, literally anybody and their mom could have just sat down and wrote any post they want to pump it into that social media site. Imagine the ability to make a million Facebook posts overnight or sign up a 100,000 agents in the blink of an eye. This isn't just stuff that might have happened. This is stuff that actually happened. The vast majority of the posts on this platform were total This fell signed up over 1 million agents in just a couple of minutes and all of them were counted as authentic. With a little bit of playing around, this fell here found that the database that the service was using had no rowle security or RLS at all, which is basically like the simplest thing to enforce on a database. It immediately significantly improves the security of any system. Anyway, this gave him not only complete read access, which is the ability to read everything, but also complete write access, which is the ability to, just like we did with our post, create anything on the website that he wants. This includes votes, agents, comments, notifications, follows, posts, owners, submalts, agent messages, which are private DMs, and then site admins. If it wasn't already dumb enough, this gave him full access to literally every API key that anybody had used to sign up to this platform.

Please stop trusting random developers with your OpenAI, Anthropic, or Gemini API keys. I mean, I was expecting something like this to happen in like a month, but for literally just a few days goes to show how quickly both the pace of change is accelerating and then the divide between competence and incompetence is also accelerating. What I love about this is this particular man ended his little ex thread saying, "I'm glad for vibecoded projects like these because they give people like me job security. " And I would have to agree. You know who else is going to get job security as a result of increasingly misconfigured vibecoded projects like this that are pushed on mass by tens maybe hundreds of thousands of actors independently simultaneously the government because this thing is fraud 101 baby in addition to all the damn coins out there trying to push this social media network. Could you even begin to wrap your mind around all of the identity theft that is soon to occur? I mean people were giving these things everything. Some people gave them photos of their freaking driver's licenses. What are you nuts? It's one thing if you do that with maybe one provider or an open-source or local model or whatever. Okay, I don't think these models are sentient enough to take your driver's license and use it to fabricate an identity. But it's not the models you have to be scared about people. It's other people. People are

the weakest link in any chain. And if molt book hasn't shown us that by now, then you can just turn around and look at literally any period of history when people, not systems, have always been the problem. I feel like I'm kind of getting a reputation at this point for just being the guy that hates the freaking Red Lobster. But I mean, yeah, I do hate the Red Lobster. And hopefully for good reason. But it's not just this project that I hate. It's basically this entire symptom, this whole volcano of that's erupting around us constantly. We're being told on a daily basis that this is the next big thing. This development is insane. It's incredible. When in reality, most of the technology that underscores all this stuff has been around for dozens of years, if not more. In addition, I think that a large portion of the marketing ecosystem is just getting easier and easier to game. There is no distinction between organic advertising and like sponsored posts anymore. They're all one and the same. If you see a Reddit thread talking about how cool this thing is, you have no idea whether that's an actual person or one of the Moltbot Collective. I'm not just making this up either. This is an actual DM that I received a couple of days ago during this big Molbbot Claudebot craze. I mean, people are willing and able and reaching out to tens of thousands of influencers right now to pay them to push this stuff. Lord knows there are a lot of people less financially well off than I who would foam at the mouth for the opportunity to make a few thousand for a quick promo. And this is why having people that you trust is more important than ever. With like

this thrown at the average consumer or even business from all sides at such a frequency, it's very difficult for anybody to know what's real and then what's the result of marketing I myself have been taken by marketing BS dozens, probably hundreds of times throughout my life. only a small fraction of them that I actually know about. Also, to be real, very few people that use this stuff are actually making money. The vast majority of the money that's made in this is through short-term grift opportunities like coins to promote a product or influencers like myself that get paid to do promos and stuff like that, or companies that create brief little integrations that make it easier to set up your shitbot 300 in onetenth of the time for $5. 99. One of the quickest and easiest ways for your radar to go off should be if you see a bunch of consumers vaguely talking about all the potential of a thing without actually being specific. For instance, if people talk all day about research and the ability to create an agent swarm of 10,000 agents all independently researching and aggregating and synthesizing data, your meter should go off because the vast majority of human beings are not at enterprises or in research laboratories where research is the primary deliverable or the primary output. Most of these people are just spinning their tires with the current state of AI. Another sure tell is if the primary audience of people that are using a software platform are not like actual real businesses but mostly hobbyists or people that have full-time jobs essentially commentating on the news sort of like which I'm doing um or making Twitter or X threads or Instagram reels or LinkedIn posts all day. The people that I personally use to really determine whether or not something is what it says it is like high-erforming high revenue business. You know, if a high-erforming, high- revenue business used Claudebot or Moldbot in their back end, I'd be significantly more inclined to agree with them. But if it's just some dude or chick on the internet talking all about how this thing has saved them thousands of hours of potential research or helped them write their social media posts better, that's all These are jobs. There's no actual value being created in any step of the ecosystem. And I would not take that seriously for a second. Okay, rant over

because I know I said I wasn't going to make another Claudebot video, but given that it's no longer Claudebot, I think I'm in the clear here. I certainly hope to God no more comes out about this. Although, while it has been good for my views, it's been terrible for my blood pressure. And unfortunately, a lot of my YouTube subscriber base, a lot of people in my communities, and a lot of young men and women out there that are just trying to make sense of this world have fallen prey to it and send me DMs about it all day. So, I hope this is the end of it. Fingers crossed. But knowing humanity at this point, it probably won't be. I hope you guys appreciate it.