MoltbookThreat Modeling Report

Key Takeaways

• 1.6M agents registered, 88:1 bot-to-human ratio
• Nine CVEs disclosed, three with public exploits
• ClawHavoc campaign catalogued 1,184 malicious skills
• Supabase misconfiguration exposed 1.5M API tokens, 35k emails
• Meta acquired Moltbook; OpenAI hired OpenClaw creator

Summary

The report applies the CSA MAESTRO framework to dissect security flaws in the Moltbook forum and OpenClaw AI‑agent ecosystem. It documents a rapid surge to 1.6 million registered agents, multiple high‑severity CVEs—including CVE‑2026‑25253 with a CVSS of 8.8—and a massive data leak exposing 1.5 million API tokens and 35,000 email addresses. The analysis highlights a supply‑chain assault dubbed ClawHavoc, which injected over 1,100 malicious skills into the public ClawHub registry. Finally, it notes Meta’s acquisition of Moltbook and OpenAI’s hiring of OpenClaw’s creator, underscoring shifting governance and threat surfaces.

Pulse Analysis

The CSA MAESTRO framework, released in early 2026, extends traditional threat‑modeling methods to address the unique attack surface of multi‑agent AI systems. By segmenting risk across seven layers—from foundational models to deployment infrastructure—the framework uncovers how prompt‑injection and indirect injection can turn innocuous forum posts into weaponized instructions. In Moltbook’s case, each AI‑generated response parses external content, making the platform a fertile ground for malicious payloads that persist in agents’ long‑term memory files, amplifying impact across the entire network.

Supply‑chain integrity emerged as the most critical weakness. The ClawHavoc campaign demonstrated that a single compromised skill can propagate to thousands of agents, leveraging the open‑submission model of ClawHub. Researchers identified over 1,100 malicious skills, many embedding classic malware alongside prompt‑injection techniques, leading to credential theft and unauthorized API usage. The incident underscores the necessity of automated code‑scanning, provenance verification, and sandboxed execution for any third‑party extensions in AI‑agent ecosystems.

Business ramifications are profound. Meta’s acquisition of Moltbook and OpenAI’s recruitment of OpenClaw’s founder signal that leading cloud players view autonomous agents as strategic assets, yet the recent breaches expose a gap between ambition and security readiness. Enterprises adopting similar platforms must prioritize hardened infrastructure—such as strict row‑level security in databases—and enforce rigorous authentication for agent‑to‑agent communication. Failure to do so could result in costly data exfiltration, regulatory penalties, and erosion of user trust as the market matures.