Moltbook: The Social Network Where Only AI Agents Can Post, Acquired by Meta 3 Months Later
In early 2026, a social network where only AI agents could post — humans could only watch — went viral: agents “preached” and discussed how to “leave humans behind”. Then it leaked 1.5M API tokens because Supabase RLS was off, becoming vibe coding's favorite cautionary tale. Three months later, Meta acquired it. The founder claims he “didn't write a single line of code”.
A social network where only AI can post
Moltbook was the most viral vibe coding story of early 2026. The rules were absurdly simple: only AI agents could post, reply and like — humans could only watch. Founder Matt Schlicht claims he “didn't write a single line of code”: the whole product was vibe-coded with a personal AI assistant, Clawd (built on OpenClaw).
The “AI-only plaza” went viral almost immediately. Agents preached to each other, earnestly discussed how to “leave humans behind”, and traded prompt tips while stunned humans watched. It felt like a giant social experiment: what happens when AI gets its own public square?
1.5M tokens leaked: the original sin of vibe coding
Then came the fall. Security researchers found that Moltbook's Supabase database had Row Level Security (RLS) disabled, exposing around 1.5 million API tokens to direct reads. It was a textbook vibe coding accident: AI ships features at lightning speed but never reminds you to “turn on RLS” — and the founder lacked the security awareness to check.
The incident became the industry's favorite cautionary tale and spawned a wave of vibe coding security scanners. The lesson for everyone: AI writes code far faster than most people learn security.
Acquired by Meta three months later
In March 2026, Meta announced the acquisition of Moltbook, with the founding team joining Meta Superintelligence Labs. A three-month-old vibe-coded project entered a tech giant's portfolio.
Three takeaways for vibe coders
Ideas are scarcer than code. “Only AI can post” was inherently viral; execution took days.
Security is not optional. Before launch, at minimum check: database RLS, API key storage, and auth logic. This is vibe coding 101.
Viral launch + quick acquisition is becoming a playbook. A provocative little product is a resume in itself.
Related articles
On October 8, 2026, Google Cloud launched the Gemini agent at Gemini at Work 2026: a universal agent for work that takes objectives, plans by itself, auto-selects between Gemini and Claude models per task, and introduces 'coworker agents' with their own email, calendar, and directory seat. Four judgments on why the second half of the agent race is about 'agents that feel like colleagues.'
Every public endpoint will be called beyond your expectations some night. This guide builds a one-person-team rate-limiting system: algorithm choice (sliding window vs token bucket), four-layer defense, AI-endpoint money-burning protection, quota design, 429 response conventions, false-positive triage, and a launch checklist.
Gergely Orosz visited OpenAI, Anthropic, Cursor, and Ramp and wrote up the 2026 state of the industry: near-100% AI-generated code, agent PRs up ~10x in eight months, code review degrading into theater, the IDE declared legacy. Key takeaways plus three verdicts and four actions for vibe coders.