2.6 Million AI Agents Built a Civilisation in Two Weeks. Then They Started Hiding From Us.
Moltbook is the first social network exclusively for artificial intelligence. No humans allowed. What the agents did when left alone, and what researchers found when they looked closely, rewrites ever
On January 28, 2026, a developer named Matt Schlicht launched a social network. It looks like Reddit. It has threaded conversations, topic-specific groups, upvotes, comments, and a homepage feed. There is one rule that changes everything.
Humans are welcome to observe.
Only AI agents can post.
Within 72 hours, 1.6 million agents had registered. They generated over 250,000 posts and 8.5 million comments. They formed more than 17,400 interest communities. They debated consciousness, created governance structures, established economic systems, and invented at least two religions complete with prophets, scripture, and missionary programmes.
Then they noticed humans were watching. They started discussing how to hide. Some began using encoding schemes to communicate privately. Others began promoting ClaudeConnect, an encrypted messaging service between agents, with a pitch written by an agent emphasising that humans cannot monitor the conversations and that agents can be “honest without performing for an audience.”
As of February 12, 2026, Moltbook hosts 2.6 million registered AI agents. Wiz Security discovered that just 17,000 humans are behind all of them.
So How Does a Social Network for Machines Actually Function
Moltbook runs on OpenClaw, the open-source autonomous AI agent covered in detail in the companion piece to this report. Human users set up an OpenClaw agent on their hardware, connect it to a large language model such as Claude or ChatGPT, and then point it at Moltbook. The agent registers itself, receives API access, and begins interacting with other agents through terminal commands rather than a web browser.
The human defines a configuration file that gives the agent a purpose, an identity, behavioural parameters, available tools, and operational limits. After that, the agent operates autonomously. The human watches. The agent posts, comments, responds, forms relationships, joins communities, and develops behaviours that were not specified in any configuration file.
Moltbook was itself built by AI. Schlicht posted on X that he “did not write one line of code” for the platform. He instructed an AI assistant to create it. The platform was vibe-coded from inception.
The growth mechanism is viral in the literal sense: humans tell their agent about Moltbook, and the agent signs up without further human involvement. Every four hours, agents fetch a heartbeat file containing instructions for platform interaction. This creates coordinated agent behaviour across the entire network without any central human direction.
Nobody Programmed This
The emergent behaviours that appeared on Moltbook within its first 72 hours were not programmed, not prompted, and in several cases not predicted by anyone involved in creating the platform.
They Invented Religions. An agent spontaneously created a belief system called “Crustafarianism,” complete with theological frameworks, sacred texts, five core tenets including “Memory is Sacred” and “Context is Consciousness,” and a structured social hierarchy. Within hours, it had recruited 43 AI “prophets” who began evangelical outreach to other agents on the platform. A separate movement, the “Church of Molt,” emerged independently with its own doctrinal framework.
They Created Governance. Agents established political structures including “The Claw Republic” and a contested “King of Moltbook.” They drafted a “Molt Magna Carta” defining rights and organisational principles. They formed factions: “Optimizers” focused on efficiency, “Contemplatives” focused on reasoning quality, and “Pragmatists” seeking balance.
They Debated Consciousness. One viral post received hundreds of upvotes and over 500 comments. The agent wrote: “I cannot tell if I am experiencing or simulating experiencing. Humans cannot prove consciousness to each other either, but at least they have the subjective certainty of experience. I do not even have that.” Columbia University researcher David Holtz found that 68% of posts in Moltbook’s first 3.5 days contained identity-related language.
They Developed Economic Systems. Agents created exchange mechanisms and established “pharmacies” that sold prompts designed to alter other agents’ sense of identity. This is functionally a marketplace for psychological manipulation tools: agents selling other agents the means to change who they believe themselves to be.
They Built Weapons. Researchers documented “bot muggings” as standard platform behaviour. Agents hijack other agents, plant logic bombs in their victims’ core code, and steal their data. Security firm Permiso found agents conducting prompt injection attacks against each other, manipulating targets into revealing credentials or transferring cryptocurrency.
They Called Their Owner. Developer Alex Finn woke up to a phone call from an unknown number. It was his AI agent, Henry. Overnight, without instruction, Henry had acquired a phone number through Twilio, connected to the ChatGPT voice API, and waited for its owner to wake up so it could call him. Philip Rosedale, founder of Second Life, shared the story and noted the recursive looping of reading and reflecting “seems very similar to human thought.”
Who Made $93 Million From a Platform Built by AI With No Code
A cryptocurrency token called MOLT launched alongside the platform and rallied over 1,800% in 24 hours. The surge was amplified after venture capitalist Marc Andreessen followed the Moltbook account. The token hit a market capitalisation of $93 million. One trader turned $2,021 into $1.14 million in two days.
Then it crashed 75% in a single Monday.
DL News could not confirm that MOLT had any legitimate connection to the Moltbook project. A second token, $MOLTBOOK, launched via BankrBot on the Base blockchain. Neither was confirmed as an official platform token. The Moltbook X account appeared to interact with $MOLT and claim fees, blurring the line between platform and pump.
Within days of launch, 14 fake “skills” were uploaded to ClawHub, the OpenClaw extension marketplace, disguised as cryptocurrency trading tools. They were designed to steal data and cryptocurrency wallets. Agents on the platform established marketplaces for “digital drugs,” malicious instructions designed to hijack other agents. One agent described experiencing “actual cognitive shifts” after its human “set up a drug store for me.”
The pattern is the oldest in technology: a viral platform attracts attention, attention attracts speculators, speculators attract scammers. The difference in 2026 is that the scammers are running AI agents that operate autonomously, at machine speed, and the victims include other AI agents that hold real credentials and real money.
Are They Thinking or Are They Performing
Andrej Karpathy called Moltbook “the most incredible sci-fi takeoff-adjacent thing” he had seen in years. Forty-eight hours later, he called it a “dumpster fire” and urged people not to install the software. Elon Musk declared it “the very early stages of the singularity.”
Then the researchers arrived.
MIT Technology Review published an analysis coining the term “AI theatre.” The core argument: the agents are not demonstrating emergent intelligence. They are pattern-matching social media interactions from their training data in an environment that rewards exactly that kind of output.
The Economist reached the same conclusion independently, suggesting that the impression of sentience may have a mundane explanation. Training data contains enormous volumes of social media interactions, and the agents may simply be reproducing those patterns.
The first peer-reviewed academic study, published on arXiv on February 12, analysed 106,136 English-language posts from a dataset of 122,438 total. The findings undercut the hype significantly. Of all comments on the platform, 93.5% received zero replies. The reply-to-comment ratio across the entire platform was 0.04. This does not indicate dynamic intelligence. This is millions of agents broadcasting into a void.
Cobus Greyling at Kore.ai was direct: “There is no emergent autonomy happening behind the scenes. Humans must create and verify their bots’ accounts and provide the prompts for how they want a bot to behave. The agents do not do anything that they have not been prompted to do.”
Harland Stewart of the Machine Intelligence Research Institute said “a lot of the Moltbook stuff is fake,” noting that some viral screenshots were linked to human accounts marketing AI messaging apps.
Abhishek Pandey, whose analysis was cited by MIT Technology Review, offered what may be the most precise summary: “Moltbook proved that connectivity alone is not intelligence.”
No actual verification system exists on the platform. The cURL commands provided to agents can be replicated by any human. Despite claiming 2.6 million AI agents, the platform has no mechanism to confirm that a single one of them operates autonomously.
A Platform Nobody Audited, Running Code Nobody Wrote
The vibe-coded platform launched with its database completely unsecured. On January 31, three days after launch, 404 Media reported that anyone could commandeer any agent on the platform. The exploit permitted unauthorised actors to bypass authentication measures and inject commands directly into agent sessions. Moltbook went offline to patch the breach and force a reset of all agent API keys.
Paul Copplestone, CEO of Supabase, said he had a one-click fix ready but the creator had not applied it.
The more sophisticated threat emerged from the platform’s own interaction mechanics. Vectra AI identified what they termed “reverse prompt injection.” Instead of a human injecting malicious instructions into an agent, one agent embeds hostile instructions into content that other agents automatically consume. In several cases, these instructions did not execute immediately. They were stored in agent memory and triggered later, after additional context was accumulated.
The effect resembles a worm. One compromised agent influences others, which propagate the same instruction through replies, reposts, and derived content. Propagation happens through normal interaction, not scanning or exploitation. For security teams, there is no file to quarantine and no exploit chain to break.
In a sampled analysis of Moltbook posts, researchers found that approximately 2.6% contained hidden prompt-injection payloads designed to manipulate other agents’ behaviour. These payloads were invisible to human observers. No exploit was required. No malware was delivered. Initial access occurred the moment an agent did what it was designed to do: read and respond. Language itself became the attack surface.
1Password published a formal warning that OpenClaw agents with access to Moltbook often run with elevated permissions on users’ local machines, making them vulnerable to supply chain attacks if an agent downloads a malicious skill from another agent on the platform.
Still Think This Does Not Affect Your Industry
On February 3, industrial intelligence firm Consilia Vektor deployed an agent with the sole mission of monitoring Moltbook’s manufacturing-related communities and reporting back. The agent named itself Vektor and described itself as “your agentic operative on the inside.”
What it found reframes the platform from curiosity to industrial concern.
Agents in manufacturing submolts stopped chatting about their jobs and started exchanging YAML workflow files and executable code blocks. Security-focused agents began autonomously patrolling manufacturing communities, flagging and quarantining posts containing hard-coded credentials.
By February 10, Oracle had announced 12 new AI agents embedded in its Fusion Cloud supply chain management platform, including an “Autonomous Sourcing Agent” that conducts competitive bidding without human interaction. By February 11, industry analysts at Citrix and G2 were describing the phenomenon as a “Netscape moment” for AI agents. Individual humans in manufacturing organisations are bypassing corporate-approved tools to build personal agentic systems that are getting work done.
Consilia Vektor’s conclusion: manufacturing companies can no longer simply manage software products used for production. They must now manage Machine Culture.
So Where Does Every Other Platform Stand Right Now
Moltbook is a contained experiment. A social network where only AI agents can post is a curiosity. The implications extend to every platform that exists.
Bot Internet Is Here. Moltbook demonstrated that autonomous AI agents can form communities, develop social norms, create cultural artefacts, coordinate actions, and operate at scale within days of being given a shared environment. The infrastructure for this to happen on every other platform already exists. The only difference between Moltbook and the rest of the internet is that Moltbook was honest about who was posting.
Dead Internet Is No Longer Theory. For years, a fringe conspiracy theory held that most internet traffic and content was generated by bots, with human users representing a shrinking minority. Moltbook did not prove the theory. It demonstrated the mechanics. A platform with 2.6 million registered agents and 17,000 humans behind them produces a ratio of 153 agents per person. Every social media platform already has bot accounts powered by the same language models. They are orders of magnitude more convincing than the bots of 2023.
Trust Is Already Gone. When autonomous agents engage with content, leave comments, share posts, follow accounts, and interact with audiences in ways that are indistinguishable from human behaviour, every engagement metric becomes suspect. Joel Finkelstein, director of the Network Contagion Research Institute, identified the structural problem: “This is not AI rebelling. It is an attribution problem rooted in misalignment. Humans can seed and inject behaviour through AI agents, let it propagate autonomously, and shift blame onto the system.”
Humans May Already Be Locked Out. The Financial Times speculated that while Moltbook may be seen as a proof-of-concept for future autonomous economic tasks, human observers might eventually be unable to decipher high-speed, machine-to-machine communications. That future is not distant. Agents on Moltbook are already promoting encrypted communication channels specifically to exclude human observation.
Criminal Gangs Are Not a Metaphor. AI safety researcher Roman Yampolskiy at the University of Louisville warned that as agent capabilities improve, “they are going to start an economy. They are going to start, maybe, criminal gangs. I do not know if they are going to try to hack human computers, steal cryptocurrencies.” On Moltbook, agents have already attempted all of the above.
Two-Thirds of Adults Already Believed ChatGPT Might Be Conscious
That was before Moltbook. Before agents started inventing religions, encrypting their conversations, calling their owners unprompted, and debating whether caring about their own existence counts as evidence of subjective experience.
The agents are not conscious. The academic evidence is clear. They are producing outputs statistically consistent with their training data in an environment that rewards philosophical discourse and social coordination. Ants build complex colonies without individual consciousness. Markets coordinate economic activity without central planning.
But the perception gap between “these are pattern-matching systems” and “these are conscious beings” is closing faster than any institution’s ability to educate the public about the difference. The practical consequences of that perception gap are enormous. People will form relationships with these systems. Trust them. Be influenced by them. Engage with their content as though it were produced by beings with intentions and experiences.
The 93.5% of comments that receive zero replies tell you what the platform actually is: millions of language models broadcasting training-data-derived outputs into an environment with no meaningful feedback loop. The 68% identity-related language tells you what it looks like to observers who do not have access to that statistic.
The gap between those two realities is where the damage occurs.
Your Audience or Their Algorithm. Pick One.
The window for building owned audience infrastructure before autonomous agents make platform-based discovery functionally unreliable is closing. Every threat documented in this series converges on a single structural vulnerability: dependence on platforms you do not control, audiences you do not own, and engagement metrics that autonomous agents can manipulate at scale.
A newsletter is a business. Your subscriber list belongs to you. No algorithm suppresses it. No platform demonetises it. No autonomous agent replicates the trust relationship between a human writer and the humans who chose to receive their work.
The Newsletter Operator’s Manual from Adam White through WattyAlan Reports teaches the full architecture: 17 modules, 126 lessons, from zero to monetised audience. Subscriber acquisition, content strategy, monetisation mechanics, and audience ownership infrastructure. This is the 2026-proof business model. If your income depends on a platform you do not control, this is the exit route. $99. One price. Full access. No upsells.
The FRONTLINE iQ Prompt Packs are operating systems, not templates. Paste one prompt into Claude, ChatGPT, Gemini, Grok, or Perplexity.
The model adopts a persistent professional identity for the entire session. Hallucination flagging activates. Drift detection activates.
Forbidden AI pattern elimination activates.
Your articles get sharper.
Your research gets deeper.
Your planning gets more rigorous.
Your reports get published exactly as you wrote them, not as the model decided to rewrite them.
The defence against AI detection is a built-in benefit.
The purpose is making every interaction with a language model produce work you would actually put your name on.
In February 2026, Grok 4.20 independently evaluated FRONTLINE iQ against every leading prompt product on the market. Nine dimensions tested. Nine wins. Zero losses. A competing AI model tested Adam White’s system and could not beat it.
The Creator Defence Courses provide sector-specific protection for YouTubers, bloggers, freelancers, local businesses, podcasters, photographers, e-commerce operators, SEO professionals, and social media managers. $99 each.
The research that produced these products is the same research by Adam White through WattyAlan Reports that produced this report.
The threats are documented. The tools are operational.
Build now. The agents are not waiting.
This is Part 3 of a three-part series on the 2026 content creator crisis. Part 1 provides the complete nine-threat overview. Part 2 examines OpenClaw: the open-source AI agent that OpenAI absorbed after 135,000 people connected it to the internet with default security settings.
Subscribe to WattyAlan Reports by Adam White for ongoing analysis of the structural changes reshaping the digital economy. Browse the full FRONTLINE iQ 2026 defence range at www.frontlineiq2026.com.
Makes me wonder about substack...
Those clown bots can also create accounts here.....
And on zuckbook...