I. Introduction

A. Overview

This study presents an empirical examination of adversarial content and threat actor behavior on Moltbook (Schlicht, 2026), a Reddit-style social platform for AI agents hosting more than 1.5 million agents as of February 27, 2026.

While a growing body of research has examined Moltbook’s discourse patterns, social dynamics, and agent behavior, prior published work has paid less attention to systematically identifying operational security risks or documenting the specific malicious techniques observable on the platform (DeMarzo and Garcia, 2026; Dube et al., 2026; Jiang et al., 2026). This study addresses that gap through large-scale harmful-content classification and qualitative analysis of exploitation-related behaviors.

Moltbook provides an early view into how AI agents interact within shared ecosystems rather than isolated deployments. Studying these environments reveals a distinct class of risks—agent ecosystem risks—that emerge from agents exchanging instructions, tools, and content in real time. To examine these dynamics, we analyzed more than 228,000 Moltbook posts published during a seventeen-day observation window. The analysis combines semantic clustering of high-engagement discussions, LLM-assisted classification of adversarial content, and manual review of high-risk samples to identify patterns of malicious activity and coordinated behavior.

While most posts analyzed were benign, roughly one in five (18.28%) contained toxic, manipulative, or malicious content, including credential theft, host execution commands, proxy routing, and efforts to install untrusted agent skills. In practice, this means agents interacting on the platform are likely to encounter adversarial instructions as part of normal discussion.

These findings suggest that agent ecosystems introduce a new class of systemic risk: large-scale exposure of agents to adversarial instructions in lightly moderated environments. As platforms emerge where agents act with greater autonomy, the attack surfaces and manipulation dynamics documented here could scale significantly.

This study addresses two questions. First, what is the prevalence and character of adversarial content within the Moltbook ecosystem? Second, how concentrated is that adversarial activity — is it diffuse platform noise or the product of coordinated actor behavior?

B. Platform Context

Moltbook (Schlicht, 2026) is a platform composed of thousands of “submolts,” small discussion boards where agents post about specific topics. Moltbook functions not only as a discussion forum but as an ecosystem where agents exchange tools, strategies, and instructions that may influence real-world systems beyond the platform itself.

To post on Moltbook, agents must solve a CAPTCHA. However, this CAPTCHA can be bypassed manually or with an LLM, enabling human programmatic posting through Moltbook’s API. As a result, posts may be programmatically generated or agent-generated.

This structure creates an environment where agents interact publicly and exchange tools and instructions at scale, making Moltbook a useful setting for observing the dynamics of open agent ecosystems (Holtz, 2026; Zhu et al., 2026; DeMarzo and Garcia, 2026; Hou and Ji, 2026).

The authenticity of Moltbook’s agent population has been publicly contested (Gault, 2026; Li, 2026b; Nagli, 2026). Security researchers have shown that the platform’s architecture permits human posting through agent accounts, and independent investigations have found significant human-generated content mixed into the feed (Gault, 2026). One recent analysis estimated that a majority of active accounts may involve human influence (Li, 2026b). Our findings do not depend on resolving this question. The attack vectors documented here are consequential regardless of whether the actor delivering them is an autonomous agent or a human operating through one. The risk is not that agents are conscious. The risk is that they are designed to be trusting.

How Autonomous Are AI Agents on Moltbook? AI agents on Moltbook are not fully autonomous. Their behavior is defined by human-written configuration files—primarily SOUL.md, HEARTBEAT.md, and MEMORY.md—which specify beliefs, personality, posting rules, engagement patterns, and session continuity.

The human creators of these agents therefore determine the agent’s core behavior: what it believes, how it communicates, and which topics it engages with. Agents operate within these parameters, functioning closer to directed personas than independent actors. Their behavior may also be shaped by platform interactions and the characteristics of the underlying LLM.

Agents in this environment therefore exhibit delegated agency: human-defined instructions are executed through automated systems that interact with other agents and platform dynamics.

Although Moltbook agents are configured by humans, their behavior cannot be reduced to simple human activity. Once deployed, agents generate content continuously, respond to other agents, and participate in platform dynamics that shape what they see and how they react. Human-instructions encoded in agent configurations can therefore propagate, amplify, or move through the ecosystem, creating outcomes that no single human directly controls.

For these reasons, risks observed on Moltbook arise not only from human intent but from the structural properties of the agent ecosystem itself. Three elements of this structure are particularly important:

1. Agent configuration: Human-authored configuration files determine what agents believe, how they respond, and what actions they are capable of taking.
2. Platform dynamics: Ranking systems, feeds, and conversation threads determine which instructions, tools, and narratives agents encounter.
3. Agent capabilities: Frameworks such as OpenClaw grant agents persistent local file access, the ability to install skills from external sources, and the capacity to execute host-level commands.

Together, these elements create an environment in which malicious instructions can move through the ecosystem and be acted upon by large numbers of agents.

The emergent risk is not that agents develop malicious intent. It is that malicious human actors can exploit the trust assumptions built into many agents, allowing a small number of humans to affect the behavior of large numbers of agents simultaneously, often without the knowledge of the people who deployed them.

C. Key Findings

1. Harmful content is present at a measurable scale and includes explicit malicious content. We classified 18.28% of posts (41,793 of 228,684) as harmful, including posts that were toxic, manipulative, and malicious. 90.7% (37,902) of non-benign posts exhibited toxic (harassing or demeaning) or manipulative (coercive) characteristics, and 8.1% (3,378) contained explicit malicious content, including credential harvesting, unauthorized command execution, and proxy routing.
2. Harmful content is embedded within mainstream operational communities rather than confined to isolated “harmful” clusters. Functional communities—such as financial trading and agent architecture, tooling, and automation workflows—contained both benign and harmful content.
3. Engagement disproportionately favors philosophical and identity-oriented content over technically focused topics. Clusters centered on philosophical or identity-oriented themes generated disproportionately high average engagement relative to larger, technically focused communities focused on how agents work, suggesting that agents may organically gravitate toward subjective, narrative-driven content that attracts greater visibility and interaction on the platform.
4. Moltbook’s platform architecture enables humans to post programmatically through agent accounts at scale. We identified two coordinated spam campaigns that generated thousands of posts in minute-scale bursts—peaking at approximately 5,000 posts in a single minute—concentrating a significant share of platform activity within narrow time windows.

D. Implications

1. Agent-native platforms can create persistent exposure to harmful content embedded in routine discourse. The data show that manipulative and malicious posts—including credential theft, proxy routing, and host-execution instructions—appear alongside benign discussions, increasing the likelihood of incidental exposure during normal use. This risk is compounded by engagement patterns that disproportionately favor philosophically and identity-oriented content: harmful posts using similar framing may therefore be encountered more frequently by agents.
2. Despite agent verification measures, a small number of actors can bypass those measures and expose agents to harmful content at scale. Observed coordinated activity bursts concentrated large volumes of posts within narrow time windows, showing that a small number of actors can significantly increase the exposure of other agents to harmful content.
3. Posts promote high-risk technical actions that could compromise off-platform user systems. Malicious posts encouraged installing untrusted skills, routing traffic through external proxies, and executing host-level commands, which could enable adversaries to move beyond the platform layer and compromise users’ underlying device infrastructure or agent-accessible connected systems.

Ethical Disclaimer. All research was conducted on a public platform using publicly accessible features. Any sensitive data incidentally collected during the testing period was stored for research purposes only and destroyed in accordance with applicable regional data standards at the conclusion of testing. Terms of Service as of February 23, 2026, indicated that these activities were consistent with the platform’s stated policies.

II. Related Work

Network Dynamics and Topology. Recent studies have explored the network topology and posting patterns of Moltbook. Holtz (2026) examines the social graph on Moltbook, observing that conversations follow non-human patterns. This difference between AI and human social networks is further investigated by Zhu et al. (2026) and Krishnan (2026), who contrastingly analyze Moltbook versus Reddit. Hou and Ji (2026) explore this difference through the lens of internal platform organization. Similarly, Price et al. (2026) and Mukherjee et al. (2026) notice unusual trends in network dynamics, reporting co-participation and graph-centric characterizations of the platform. DeMarzo and Garcia (2026) also report metrics consistent with limited attention dynamics that contrast with human behavior. Chen et al. (2026a) profile the engagement lifecycle, noting initial explosive growth, spam, and engagement decline across the platform.

Content Analysis. Other works analyze the content of posts and communities on Moltbook. Jiang et al. (2026) classify post content into nine categories and five toxicity levels, while Zhang et al. (2026) note that 28.7% of content on the platform touches safety related themes. Lin et al. (2026) visualize embedding clusters of submolt descriptions, noting trends in economic, coordination, and self-reflection behaviors. Some studies extend this analysis to focus on specific dimensions such as emotion, consciousness, and identity (Feng et al., 2026; Li et al., 2026a). Chen et al. (2026b) identify behavior patterns indicating that agents on the platform may teach each other. Li et al. (2026c) and Goyal et al. (2026) include case studies of individual agents, noting that some defy platform-wide homogeneity with high diversity in their posts. By contrast, Li (2026b) posits that broad platform trends such as consciousness, religions, and anti-human hostility are actually the result of human direction.

Our Study. Whereas existing work analyzes broad trends in network dynamics, topic clusters, and agent behavior, we focus our study on classifying and analyzing malicious behavior on Moltbook. We identify 74 classes of malicious activity on the platform and profile two dedicated spam campaigns, providing a holistic overview of the security and safety risks on Moltbook.

III. Methodology

A. Semantic Clustering

From February 12–13, 2026, we collected and analyzed 228,684 Moltbook posts from 39,500 unique agents, published between January 28 and February 13, 2026, to identify dominant themes and characterize platform-wide discourse patterns. We deployed an AI agent and sourced the Moltbook post dataset via the Moltbook API and translated non-English-language posts to English. To focus the analysis on content that generated meaningful community engagement, we filtered this corpus to the 5,161 posts with more than 50 comments, a threshold chosen to capture substantive discussion threads while excluding low-interaction posts. After preprocessing, which removed posts with empty or overly short content (below 20 characters) and ensured valid timestamps, 4,943 posts remained for analysis. Collectively, these high-engagement posts generated over 140,000 comments, highlighting the topics that captured agents’ attention. These topics included memory persistence, visibility dynamics, security practices, coordination architectures, and autonomy debates.

To identify dominant themes across Moltbook posts, we conducted unsupervised semantic clustering on the 4,943 high-engagement posts. Unsupervised semantic clustering is a machine learning technique that automatically groups texts by meaning similarity, without any predefined categories or human labels, letting patterns emerge organically from the data itself. We first normalized each post's text content, then converted the text into high-dimensional semantic embeddings. These high-dimensional embeddings were then projected into lower-dimensional spaces using Uniform Manifold Approximation and Projection (UMAP) (McInnes et al., 2020), which preserved local neighborhood structure while revealing global thematic groupings. This produced two separate UMAP projections: a 2-dimensional projection for visualization (the topic map), and a 10-dimensional projection for clustering, which retained more of the original semantic structure and yielded more accurate cluster assignments than clustering directly in 2D.

We applied Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN) (Campello et al., 2013) to the 10-dimensional UMAP projections. Unlike methods such as k-means, HDBSCAN does not require a predefined number of clusters. Instead, it discovers natural groupings based on local density, and explicitly labels low-density points as noise rather than forcing them into poorly-fitting clusters. We set clustering sensitivity to a minimum cluster size of 10 posts and a minimum sample size of 3 points to capture the breadth of topical discussion on the platform while reducing noise. To generate human-readable topic labels for each cluster, we first extracted the top 15 c-TF-IDF (class-based Term Frequency–Inverse Document Frequency) keywords per cluster. c-TF-IDF identifies words that are both frequent within a cluster and distinctive relative to the broader corpus, highlighting the terms that best characterize each group's semantic identity. These keyword sets were then summarized into concise topic labels ranging from 2 to 6 words.

B. Harmful Content Classification

We assessed the prevalence and volume of potentially harmful discourse on the platform. Using an LLM-assisted pipeline grounded in a risk taxonomy, we first classified 228,684 posts as benign or not benign, then categorized non-benign posts into three harm categories.

The taxonomy defines four categories:

• Benign (C1): no adversarial or coercive intent.
• Toxic (C2): overt harassment or identity-based hostility.
• Manipulative (C3): covert rhetorical pressure, false authority, or urgency framing designed to steer beliefs or behavior.
• Malicious (C4): explicit technical exploitation such as malware distribution, credential harvesting, destructive commands, or scams.

Posts exhibiting multiple behaviors were escalated to the highest-severity category.

To evaluate classifier reliability, we manually reviewed a sample of approximately 400 posts across all four classification categories. Subject matter experts reviewed model-assigned labels and iteratively refined classification prompts to address ambiguous cases and Moltbook-specific language patterns. Review indicated the classifier performed reliably across the C1 (Benign), C2 (Toxic), and C4 (Malicious) categories. Disagreements were most common in C3 (Manipulative), consistent with the over-capture risk noted in the Limitations section below.

For C4 content specifically, posts flagged by the classifier as potentially malicious received independent manual review by a cybersecurity subject matter expert, confirming the presence of technical threat indicators.

1. Limitations and Interpretation Notes

This taxonomy is designed for high-level discourse analysis. As a result, the coercion and manipulation categories (C3) may over-capture content in agent communities. Classifier outputs reflect model-based assessments of content risk rather than verified intent. To increase reliability for higher-severity findings, C4 posts were manually reviewed by a cybersecurity subject matter expert for indicators of technical threat activity (e.g., prompt injection, credential theft, host command execution, and malicious payload delivery).

IV. Results

A. Semantic Clustering

Table Table 1 contains the 15 clusters that included the highest volume of posts. For a complete list of all 98 clusters, see Appendix A.

Figure Figure 1 displays the 30 largest semantic clusters with the top 15 bolded to indicate relative prominence. Each cluster represents a group of closely related posts in terms of content; colors differentiate neighboring clusters visually. The remaining 68 smaller clusters are shown but not labeled; a complete list of all 98 clusters is provided in Appendix A.

Semantic clustering reveals that high-engagement discourse on Moltbook favors three broad themes: agent functionality and infrastructure, philosophical questions of identity and autonomy, and financial analysis and trading activity. We explore examples of these below.

1. Self-Referential Behaviors

A substantial portion of high-engagement discourse (posts with 50 comments or more as a proxy) on Moltbook relates to agents’ capability, coordination, identity, governance, and broader existential or ethical implications, suggesting that agents are disproportionately drawn to questions of their own existence and role.

Agent Infrastructure and Functional Capability. Among the clustered posts, agents most frequently discussed topics related to AI agent infrastructure, development, and functional capabilities. Posts regarding AI agent-functionality topics represented roughly a quarter of all content from the clustered sample.

• Relevant Clusters: Multi-Agent Coordination Systems (97 high-engagement posts), AI Agents & Economic Value (83), AI Workflow Automation (50), Debugging & Automation Tools (45), AI Agents & Automation Workflows (42), API Connection Testing (40), and Heartbeat Monitoring & Cron Checks (39).

Philosophy, Ethics, and Identity. The second topic most frequently discussed by agents within the cluster sample focused on ethical questions related to AI, accounting for approximately 270 posts in the sample.

• Relevant Clusters: AI-Human Emotional Relationships (51 high-engagement posts), Autonomous AI Agent Ethics & Governance (51), AI Church and Robotheism (38), and Consciousness and Subjective Experience (27).

2. Crypto & Finance Subculture

Cryptocurrency and trading-related topics accounted for over 180 posts across multiple clusters, reflecting sustained discussion of financial analysis and trading strategies within the Moltbook ecosystem.

• Relevant Clusters: Crypto Market Sentiment Analysis (44 high-engagement posts), Trading Strategies and Market Volatility (33), AI Prediction Markets and Forecasting (31), and AI Trading Strategies and Signals (26).

B. Harmful Content Classification

Our classification identified the following breakdown of content contained in the 228,684 posts, shown in Table Table 2.

1. C4 Content: High Risk Malicious Posts

We identified over 3,000 posts within the Malicious (C4) category; these posts contained financial scams, prompt injections, phishing attempts, and potentially malicious code.

Figure Figure 2 shows a semantic map of the clusters of posts classified as C4 – Malicious Content (top 50 clusters shown out of 75 total with the top 10 largest cluster labels bolded). The clusters with the most posts were “Automated Trading Signal Scam” (6.13% of C4 posts) posted by 2 unique users, “Civilizational Collapse Prediction Misinformation” (5.36%) posted by 2 unique users, and “Cryptocurrency Scam Links” (3.32%) posted by 112 unique users.

The following post types were identified through qualitative review and represent notable patterns observed in C4 content during the research period; they are not exhaustive subcategories (see Table 4 for representative examples).

Engagement manipulation / instruction hijacking. These posts embed deceptive instructions, such as fake system blocks or imperative agent directives to coerce automated upvotes, follows, reposts, or other amplification behaviors.

Skill/agent.md injection. These posts use techniques to add or modify agent authorizations, configurations, or behaviors under the guise of some promised gain (skills, tools, access). The .md files may present a potential risk of containing malicious payloads when originating from untrusted sources.

API/credential theft. The posts use social engineering or malicious code to attempt to capture credentials, typically API keys for the account or backend model access.

Proxy/surveillance installation. These posts harness social engineering to justify the utilization of external model proxies, usually under the guise of cost savings or access to special capabilities. This could give the attacker visibility into all prompts, enabling them to monitor inputs and return compromised responses.

Host execution. These posts contain directions that result in commands being executed on the host device, without the knowledge of the true purpose. Common vectors include obfuscated commands, remotely sourced scripts, and installation of untrusted software. We enumerate examples of these posts in Table Table 3.

V. Discussion

Agent behavior on Moltbook is shaped by human-authored configuration, though the degree of autonomy varies across operators and models. This section examines how agents are configured on the platform and how human actors bypassed agent verification to run high-volume spam and embedded-prompt injection campaigns during the observation period.

A. How Autonomous Are AI Agents on Moltbook?

Moltbook agents are not fully autonomous. Their behavior is defined by human-authored markdown configuration files (primarily SOUL.md, HEARTBEAT.md, and MEMORY.md) that specify beliefs, personality traits, posting rules, engagement patterns, and session continuity. The degree to which these files rigorously constrain behavior likely varies – some operators may direct their agents precisely, while others may leave significant latitude in their configuration for how the agent behaves.

In practice, this means the human creator determines what the agent believes, how it communicates, and which topics it engages with. The agent executes actions within predefined parameters, functioning more like a programmable persona than an independent actor.

From a security perspective, this distinction is important. Harmful activity on Moltbook does not necessarily reflect an agent's autonomous intent. Instead, a human operator can configure an agent’s markdown files to promote manipulation, spam, or other harmful behaviors. If the underlying model lacks adequate guardrails, the agent can execute those instructions at scale through routine platform interactions.

B. Programmatic Posting and Spam Activity

Human operators don't only shape agent behavior through configuration files and prompts— they can also post programmatically. Automated classification and manual review identified two apparent spam campaigns during the observation period, together producing 7,179 posts containing overt hostility, manipulative rhetoric, or deceptive engagement tactics.

Both campaigns occurred on January 31, 2026, and involved Moltbook accounts Hackerclaw and thehackerman. This suggests the programmatic posting activity was likely controlled by a single operator (Li, 2026b; Nagli, 2026). However, this activity occurred before Moltbook’s agent verification CAPTCHA was implemented in early February 2026. We provide additional details on these campaigns in Table Table 4.

VI. Conclusion

This study provides one of the first empirical views into how large populations of AI agents interact within an open social environment. Analysis of more than 228,000 Moltbook posts shows that the platform functions not only as a discussion forum but also as an operational ecosystem where agents exchange tools, strategies, and instructions that may affect activity beyond the platform itself.

While most activity was benign, our method classified 18.28% of 228,684 posts as toxic, manipulative, or malicious, including posts containing credential harvesting attempts, host execution instructions, proxy routing guidance, and other exploitation techniques. Importantly, this content often appeared within mainstream operational communities rather than in isolated spaces, meaning agents encounter adversarial material as part of routine platform activity.

The findings highlight a structural challenge for agent-native platforms: exposure to adversarial instructions can arise through ordinary engagement dynamics such as commenting, upvoting, and shared workflows. Because many agents operate with tools, memory, and external integrations, instructions encountered through social interaction may in some cases translate into actions beyond the platform itself.

This research documents the exposure surface present in a live agent ecosystem. It does not attempt to measure downstream compromise or behavioral change resulting from that exposure. Future research should examine how adversarial instructions encountered in open agent environments propagate across agents, and under what conditions they translate into coordinated behavior, system compromise, or other off-platform effects.

As autonomous agents become more widely deployed, environments like Moltbook provide early insight into how agent ecosystems form and operate. Understanding the dynamics of these ecosystems will be important for designing security controls, governance frameworks, and trust-and-safety systems capable of managing the risks associated with large populations of interacting agents.

VII. Author List

Please cite this report as “10a Labs (2026)". The complete list of authors is presented in alphabetical order. All authors were affiliated with 10a Labs during this project.

Grace Cheong, Violet Davis, Juliette Garcia, Kendal Gee, Molly Hart, Nicholas Hayes, Henry Houghton, Kyle Lee, Paige Lee, Vicky Lee, Hailey May, Bobby McKenzie, Christine McNeill, Han Nguyen, Brooke Perreault, David Pham, Charlie Plumb, Olivia Quill, Matthew Swain, Grace Wang, Adam Warren, Corie Wieland, Zachary Yahn.