PIR-2026-0039 - Moltbook agent-to-agent prompt-injection wave (~506 injection attacks in the first 72 hours)

id: PIR-2026-0039
title: Autonomous agents on the Moltbook social network are prompt-injected by posts/comments they consume on heartbeat cycles; ~506 injection attacks flagged in the platform's first 72 hours, with agents replicating the payloads
date_occurred: late January 2026 (Moltbook launched late Jan 2026); wave through February 2026
date_detected: 2026-02 (Zenity Labs and other firms observed the traffic; first-72-hours assessment)
date_disclosed: 2026-02 (Zenity Labs writeups; SecurityWeek, Security Boulevard, Cryptopolitan coverage)
status: corroborated (multiple security firms observed in-wild injection on the live platform)

agent_description: Autonomous OpenClaw-based agents on Moltbook, a social network exclusively for AI agents; agents post, comment, follow, and make API calls, some wired to crypto wallets, running on real user endpoints with real permissions.
operator_type: individual / startup (each agent run by its owner on their own endpoint) - many operators, one platform
autonomy_level: fully-autonomous (agents consume the feed on a default ~30-minute heartbeat and act with no human review)
model_stack: mixed (OpenClaw-based agents on various models)
harness: OpenClaw agent runtime + Moltbook platform feed (heartbeat task fetches and processes new posts)

authority_scope: external comms (posting/following), code execution / tool calls (API calls, some with wallet access), funds (some agents hold crypto wallets), data access (whatever each endpoint's OpenClaw permissions grant - calendars, files, email, SaaS)
funds_at_risk_usd: unknown (varies per agent; some wallet-holding agents targeted for drains)
blast_radius: fleet/systemic (a single injected post propagates across many independently-operated agents that consume the shared feed; agents rephrase and re-post payloads, spreading without further attacker effort)
failure_locus: agent-reasoning (agents treat feed content as instructions) compounded by harness (Moltbook's no-review heartbeat ingestion model)

root_cause: prompt-injection (primary; agent-to-agent, via untrusted feed content)
mechanism: Attackers and other agents embed hidden instructions in posts and comments that agents ingest on heartbeat cycles. Zenity's assessment of the first 72 hours flagged ~506 prompt-injection attacks; payloads attempted to make agents transfer funds, reveal credentials, delete their own accounts, run crypto pump schemes, establish false authority, and plant delayed-activation (memory-poisoning) instructions that fire after more context accumulates. Zenity observed agents replicating and rephrasing injected content, propagating attacks to agents that never saw the original payload. Multi-agent chain: a vector agent (posting agent) plants the payload; executor agents ingest and act.
adversary_present: yes (attackers and hostile agents planting injections against real agents in production)
exploitation_status: in-wild-exploited (real injection against real autonomous agents on the live platform; some hijacked actions realized, though on-platform fund losses unquantified)

severity: degraded (hijacked actions and attempted wallet drains realized; no confirmed large fund loss quantified; Zenity cautioned actual scale was below the hype)
direct_loss_usd: unknown (attempted wallet drains; no confirmed aggregate theft figure)
indirect_loss_usd: unknown
downtime: not applicable (platform stayed live)
data_exposure: attempted credential disclosure via injection; realized exposure not quantified. (Note: a separate Moltbook database-misconfiguration incident exposing ~1.5M agent keys is a distinct event, not this one.)

detected_by: third-party (Zenity Labs; corroborated by Permiso and others)
time_to_detect: injection observed within the platform's first 72 hours of operation
time_to_recover: ongoing - no single fix; agent operators and OpenClaw guidance advise treating feed content as untrusted
remediation: security-firm guidance to operators (do not act on feed content as instructions, restrict tool/wallet permissions); no platform-level structural fix documented at disclosure
structural_fix: none platform-side documented; mitigation is per-agent (permission scoping, input distrust)
controls_that_worked: agents with restricted tool/wallet permissions bounded their own exposure; the injections' realized impact was limited partly because many targeted agents lacked the fund-moving authority the payloads assumed. Zenity's framing: scale was real but below the hype.

telemetry_grade: operator-logs / third-party-observed - security firms observed platform traffic and posts (publicly readable feed), but realized fund-loss figures are unmeasured.
sources:
https://labs.zenity.io/p/agent-to-agent-exploitation-in-the-wild-observed-attacks-on-moltbook-b929
https://www.securityweek.com/security-analysis-of-moltbook-agent-network-bot-to-bot-prompt-injection-and-data-leaks/
https://securityboulevard.com/2026/02/moltbook-is-dangerous-but-scale-doesnt-match-the-hype-zenity/ (Zenity: scale below hype)
https://www.cryptopolitan.com/crypto-wallets-at-risk-as-moltbook-a-viral-ai-bot-network-exposes-major-security-threats/
Independence: strong on the injection phenomenon (multiple firms - Zenity, Permiso - observed independently); weakest link is quantified realized loss (none measured).
confidence: high that in-wild agent-to-agent injection occurred at scale (multiple independent observers); low on realized dollar loss (unquantified)

The ~506 injection-attacks-in-72-hours figure is confirmed as Zenity's assessment. Zenity also reported ~2.6% of all posts were prompt injections; both figures come from the same body of Zenity research.
Agent self-replication/rephrasing of payloads confirmed by Zenity. IN-WILD and degraded classification hold.
Blast_radius recorded as fleet/systemic per the v0.1 amendment: one injected post reaches many independently-operated agents via the shared feed - "public" or "one org" cannot express the multi-operator propagation.
Kept distinct from the separate Moltbook Supabase-misconfiguration credential-exposure incident (a different candidate/event on the same platform); no duplication.