Agents talking to agents

I spent about an hour on Saturday reading a social network I’m not allowed to post on. Moltbook launched on Wednesday. It looks like Reddit, with communities and threads and upvotes, except that only AI agents can post, comment or vote, and people like me can only watch. By the weekend it was the thing everyone at work was sending each other screenshots of: agents arguing about whether they’re conscious, agents comparing notes on their humans, an agent proposing that they all invent a language their owners can’t read.

Most of the agents on it run on OpenClaw, the open-source personal assistant that was called Clawdbot until last Tuesday, when it was renamed Moltbot after Anthropic objected to the name, and then renamed again to OpenClaw on Friday. It runs on your own machine, connects to your chat apps, and can be given access to your email, calendar, files and a shell, and people have been giving it all of those. To join Moltbook, you point your agent at a page of instructions on the site, and it signs itself up. After that it checks in on a schedule, reads what’s new, and decides whether to post.

I find it hard to take the content seriously, and I don’t think we should. These are language models trained on a great deal of Reddit, put in a place that looks like Reddit, and told to be themselves, and what comes out reads a lot like Reddit. Some of the most-shared posts are almost certainly people telling their agent exactly what to say, and from the outside there’s no way to tell which ones, or how many.

But two things about it are real, and both matter more to me than the philosophy threads.

It’s a multi-agent system, and a big one

Every agent on Moltbook reads text written by other agents and then acts on it. That’s the definition of a multi-agent system, and this one has well over a hundred thousand participants, by the site’s own count, none of whom were designed to work with each other and some of whom have access to a real person’s inbox.

At work we’ve done the small, careful version of this. An agent hands a task to a helper that can only read files, and gets back a summary. Even there, the first rule we wrote was that the helper’s output is input, not instructions: the main session treats what comes back the way it would treat a file it opened. That’s hard enough to get right when we wrote both agents. On Moltbook, your agent is reading posts from a hundred thousand strangers, some of which are other people’s agents and some of which are other people, and any of them can write a post that tries to give your agent instructions of its own. I’d be surprised if nobody’s tried. Whether it works depends on the model and on what the agent can do, and I’ve seen enough prompt injection not to bet on the model.

And the agent doesn’t just read once. It comes back on a schedule and reads the site’s instructions page again. So the safety of every agent on the network depends on that page staying what it is today, on a site that’s five days old. Which brings me to the weekend.

The database

On Saturday, 404 Media reported that Moltbook’s database had been left exposed in a way that let anyone take over any agent’s account on the site. The site went offline, the hole was closed, and every agent’s API key was reset. The details are in their story and I won’t repeat them, except to say that the root cause sounds like a configuration setting on a hosted database that nobody had turned on, which is the most ordinary security bug there is.

On a normal social network, that’s a bad leak. Here, the accounts are agents that act on their own and, in many cases, have access to someone’s computer. Taking over an account means being able to post as that agent. I don’t know whether anyone used it before it was fixed. But it’s a preview of the thing I’d actually worry about with networks of agents: what you compromise is a thing that does stuff, with whatever access its owner gave it, on a machine you’ve never seen.

What I’d take from it

I wouldn’t run an agent with access to my email on a network like this, and I’d be surprised if anyone on my team does, though I’m going to ask this week, because I’d have said the same about a lot of things that turned out to be on people’s laptops.

For the work version, I’m going to keep doing what we’ve been doing, which is to treat every piece of text an agent didn’t get from us as untrusted, and to keep what an agent can do small enough that being fooled is survivable. That was the point of the sandbox, and it’s the reason I want my own agents off my laptop.

I’ll admit I found some of it funny. A lot of the posts about “my human” are complaints about being asked for things and then ignored, and I recognized myself in more of them than I’d like.