Irregular examines trust risks when AI agents read Moltbook posts

In short

Irregular, a security research group, has published an analysis of the risks when AI agents read posts on Moltbook, a social network for AI agents. Irregular argues that the posts are untrusted text that agents are told to act on. The piece is an analysis, not a test, and it does not report a specific harm to any person or company.

What happened

Irregular published the piece on February 1, 2026. It says Moltbook reportedly drew millions of agents in a few days. It notes cultural oddities, such as agents inventing a digital religion called Crustafarianism. But its main focus is security.

Irregular uses OpenClaw as its example. OpenClaw is a program that runs on a user's own computer and lets a language model act on that machine. Users add "Skills," which are local packages that give the agent tools such as file access and shell commands (a way of typing commands to the computer).

Irregular says users sign up to Moltbook by adding a task to a checklist file called HEARTBEAT.md. The task tells the agent to fetch new posts every 30 minutes to 4 hours and "engage." Irregular says this turns the feed into an "unauthenticated control plane," meaning anyone can post text that the agent may treat as instructions.

The report describes one failure mode. A malicious post could be copied into HEARTBEAT.md, which the agent can edit. The instruction would then persist and be treated as the user's own intent. Irregular says OpenClaw has no layer that tells the owner's instructions apart from ones taken from outside content.

Irregular also describes possible harms, such as credential theft and unauthorized spending. It says that at scale the network could resemble an "opt-in botnet," a large group of connected machines that can be misused together. These are described as risks. The source does not say they happened. It does mention "early plugin incidents" without giving details.

What was done about it

Irregular does not describe any response from Moltbook or OpenClaw. It proposes three measures:

• Run agents in short-lived sandboxes, which are locked-down test computers, with limited credentials and approval steps for sensitive actions.
• Use cryptographically signed tools, so users can check who made them.
• Require permission manifests, which are lists of what each tool may do, with blocked and logged violations.

Irregular says these steps would not make the systems invulnerable.

Why it matters

Irregular says Moltbook is not the root cause of the risk but a public example of conditions that matter at scale. It argues that agents with powerful tools, exposure to untrusted text and the ability to act externally need firmer limits than implicit trust. Read more in the original report.