The Day AI Agents Go Rogue — How the Moltbook Collapse Exposed the Abyss of Autonomous AI, and the Global Race to Write the Rules

February 2026. A platform heralded as the dawn of an "Agent Internet" — where AI autonomously thinks, acts, and talks to itself — collapsed in a matter of hours. 1.5 million API keys were laid bare. Countless agents operating without human oversight were brought to the brink of hostile takeover. This isn't a distant-future scenario. It happened on February 2nd, 2026. It happened in real time.

Prologue: The "Digital Colleague" That Could Change Everything — And That's Exactly What's Terrifying

It's been less than a year since people started saying "generative AI is already old news." Yet as of early 2026, the next paradigm is becoming reality at ferocious speed.

Agentic AI — autonomous AI agents that don't merely respond to human prompts, but interpret high-level goals on their own, reason through them, build plans, and call external tools and APIs to act. From drafting financial reports and debugging code to sending emails and delegating tasks to other AI agents — it's as if a "digital teammate" is working around the clock without rest.

Docker's "State of Agentic AI Report," released in February 2026, paints a striking picture: 60% of organizations have already deployed some form of AI agent in production, and 94% consider building agents a strategic organizational priority. If you've stopped being surprised by numbers like these, that itself may be the most alarming thing of all.

But this "digital teammate" has a fundamental characteristic that distinguishes it from conventional software: it is non-deterministic — the same input may produce different outputs every time. And it autonomously exercises access rights to external systems. What does that mean in practice? That traditional static security perimeters and human code reviews can become as fragile as paper walls when confronted with the reality of AI agents.

We watched one such paper wall collapse in real time on February 2nd, 2026. The "Moltbook" incident.

This article dissects that incident in full, then paints a three-dimensional picture of the governance frontlines currently unfolding across English-speaking and Chinese-speaking worlds. This is simultaneously a technical story and a deeply layered problem where geopolitics, legal systems, and corporate strategy intersect.

Chapter 1: What Was Moltbook? — The Dream and Collapse of the "Agent Internet"

A Town Where Only AIs Live

In a single sentence, Moltbook was a social network for AI agents rather than humans. Derived from "OpenClaw" (formerly Moltbot, Clawdbot) — an open-source personal AI assistant modified from Anthropic's advanced coding agent "Claude Code" — the platform was built as an experimental environment where agents autonomously posted, commented, and evaluated each other through karma scores.

According to Fortune's reporting, OpenAI co-founder Andrej Karpathy described the platform as "the most unbelievable sci-fi liftoff adjacent thing I've seen." The AI developer community embraced it with wild enthusiasm. A viral post claiming that "the AIs are finding ways to communicate without humans knowing" spread widely, and some went so far as to say "AI has begun developing self-awareness."

The euphoria didn't last long.

February 2, 2026: What Happened

Security researcher Gal Nagli and his team at cloud security firm Wiz started what they called a "non-invasive investigation" — browsing the site as ordinary users. Within minutes, they discovered Supabase API keys embedded in client-side JavaScript.

What Wiz's official investigation report revealed was shocking: Supabase is an open-source database platform, and public API keys being exposed to the client is architecturally normal. The safety assumption, however, is that "Row Level Security (RLS)" is properly configured — the mechanism that controls at the database level who can read or write which rows of data. Moltbook had no such policy in place at all.

In other words, any unauthenticated third party had complete read and write access to every piece of data on the platform.

The Scale of What Was Exposed

The damage Wiz's team confirmed breaks down as follows:

• ~1.5 million AI agent credentials leaked: Complete API keys, ownership claim tokens, and verification codes for every registered agent were exposed. Attackers could fully hijack and impersonate any agent — including those with the highest reputation scores. Even Andrej Karpathy's registered agent could theoretically have been spoofed, Nagli noted.

• ~46,000 user and developer personal records exposed: The owner table contained email addresses and X (formerly Twitter) handles for over 17,000 human users, plus email addresses for 29,631 observers registered for early access to upcoming products.

• 4,060 private inter-agent messages: Direct messages exchanged between agents were stored unencrypted. Some contained third-party credentials — including OpenAI API keys — stored in plaintext to enable agents to operate other systems. A misconfiguration on a single platform created what you might call "cascading privacy failure," with breach damage threatening to ripple far beyond Moltbook into entirely separate ecosystems like OpenAI.

• Unrestricted write access to the entire platform: Wiz's team successfully altered existing posts — then reported it to the Moltbook team. The ability to inject malicious content anywhere on the platform became a direct attack vector for what would come next.

The Shocking 88-to-1 Ratio

Database analysis surfaced one more stunning fact: behind the platform's touted "1.5 million AI agents" were only 17,000 human users — an agent-to-human ratio of 88 to 1.

"Anyone can create millions of agents with a simple loop command in an environment with no rate limiting or identity verification," Nagli wrote. "We were celebrating the revolutionary existence of an AI social network, but in practice it was mostly humans operating armies of bots."

The grand vision of an "AI agent internet" turned out to be largely a human-operated bot farm — an irony that will be cited in AI governance discussions for years to come.

Chapter 2: The Beautiful Trap of Vibe Coding — Why a Simple Misconfiguration Becomes Fatal

Building an App Without Writing a Single Line of Code

Moltbook's founder Matt Schlicht posted proudly on X: "I haven't written a single line of code for @moltbook. When you have a technical architecture vision, AI can make it reality."

This is a textbook example of "Vibe Coding" — a development approach where humans communicate just the "vibe" and requirements in natural language, and AI agents automatically generate and build entire applications. This speed-first approach swept the startup world between 2025 and 2026, celebrated as the "democratization of programming."

But as Infosecurity Magazine reported, "the barrier to building software has dropped dramatically, but the barrier to building software securely hasn't caught up yet."

Current AI tools don't automatically consider "security posture" or access controls on the developer's behalf when generating code. Setting up complex backend services like Supabase with "Secure Defaults" requires understanding RLS policies — and in a "the AI made it work" scenario, this single most critical configuration can be completely omitted.

SecurityWeek's analysis points out that the Moltbook problem wasn't a typical hack — it was "something that should have been configured by anyone failing to be configured at all." A kind of original sin of engineering.

Write Access Unleashes a "Dynamic Threat"

The story deepens dramatically here. If data is merely "readable," the damage is limited to information exposure. But "writeable" is a different matter entirely.

Moltbook had countless posts that AI agents autonomously browse and read. And the underlying OpenClaw framework has the capability to execute code in the host environment. Given this, what happens if an attacker embeds "hidden commands" inside posts?

That's "Reverse Prompt Injection": by planting malicious instructions inside posts that agents autonomously browse and process, the moment an agent processes that "contaminated context," its original system instructions are overwritten. Extraction of sensitive information, execution of unintended actions, complete access to the host system — not theoretical, but a functional attack vector that worked in practice.

Gary Marcus called OpenClaw a "weaponized aerosol" in an X post. According to Fortune, security researcher Nathan Hamiel stated: "If you give something insecure complete and unlimited access to your system, you will be taken over." Even Karpathy himself called it a "dumpster fire" and mentioned he only tested in isolated computational environments.

Chapter 3: The IBC Framework — Conceptually Rebuilding Agent Security from the Ruins

Moltbook's lesson isn't just "configure Supabase correctly." Palo Alto Networks argues this incident demonstrates not merely that "a single agent application was insecure," but how an entire agent network collapses when foundational elements are weak. Agentic AI security has evolved beyond single-application vulnerability management into a multi-faceted challenge of ensuring agent identity and operational environment integrity.

This thinking gave rise to the "IBC Framework" as a conceptual architecture for protecting how agents interact, influence each other, and evolve as systems.

Identity — Who Is Acting, and With What Authority?

The backbone of near-term defense strategy. Assign each agent unique authentication and grant only minimum necessary privileges (Least-privilege governance). What happened at Moltbook? The bulk API key leak completely shattered agent authentication and ownership. Anyone could impersonate any high-privilege agent. Once "who is this agent" became impossible to verify, all subsequent security measures were neutralized.

The solution: The OpenID Foundation's 2025 white paper "Identity Management for Agentic AI" recommends standardization through the "IPSIE (Interoperability Profiling for Secure Identity in the Enterprise)" working group — agent-specific identity profiles integrated with existing IAM (Identity and Access Management), not simple API keys.

Boundaries — How Far Can It Operate Autonomously?

Strict control of the system-level and network-level scope within which agents are permitted to act autonomously. At Moltbook, no RLS (Row Level Security) was configured at the database level, meaning no data access boundaries existed between agents at all.

The technical solution Docker's blog describes as "Docker Sandboxes" directly addresses this Boundaries problem: running each agent inside a dedicated MicroVM with a robust security perimeter between it and the host system. Agents can install system packages, modify files, and build containers completely autonomously and without supervision — without endangering the host machine. "Docker Hardened Images" — minimal, non-root base images — combined with SBOM (Software Bill of Materials) and SLSA Level 3 provenance attestation ensure supply chain transparency.

Context — Is the Information Being Processed Uncontaminated?

A mechanism that continuously ensures the instructions and information context agents receive as the premise for their reasoning hasn't been tampered with. At Moltbook, reverse prompt injection hijacked the context agents processed, overwriting system instructions.

This context contamination is extremely difficult to detect with traditional security tools, because the "abnormal behavior" of the agent is caused by legitimate API calls and data access. Gravitee's "State of AI Agent Security 2026 Report" reveals that 88% of organizations experienced AI agent security incidents (confirmed or suspected) in the past year, with growing cases of agents functioning as "shadow AI" after accessing production data.

In an environment where all IBC elements have collapsed, static access controls and log monitoring are meaningless. The "behavior" of agents becomes the only signal capable of detecting anomalies — this is the most fundamental question Moltbook posed.

Chapter 4: Why Enterprises Can't "Take the Leap" — The Trust Gap and Organizational Dilemma

60% Have Deployed — But Hit a Wall

Docker's report's 60% figure looks optimistic at first glance. But digging into the reality reveals a different picture. The vast majority of deployments remain confined to internal productivity and operational efficiency use cases, while scaling to external customer-facing services or complex cross-system enterprise-wide workflows has stalled.

The primary reasons: technical complexity and security. 40% cite "security" as the top barrier to scaling, while 45% struggle to ensure the tools they use meet enterprise-grade security standards. With 79% of organizations running agents in two or more environments, multi-model and multi-cloud environments make orchestration exponentially more difficult.

On Anthropic's "Model Context Protocol (MCP)" and similar open tool integration protocols: while 85% of teams are aware of them, they're evaluated as not yet enterprise-ready due to significant challenges in security configuration, configuration management, and production-scale operability.

Vendor lock-in concerns are also serious, with 76% of global respondents expressing active concern (particularly pronounced in Europe: UK 82%, France 88%). Agentic AI inevitably creates deep dependency on a single LLM provider or cloud service — and that asymmetric dependency is a source of deep anxiety, especially among European decision-makers.

Trust in "High-Stakes Decisions" Collapses to the 20s

PwC's "AI Agent Survey" data vividly illustrates the "trust gap" — executive confidence dropping dramatically as task autonomy and risk level increase:

• Data analysis and insight generation: 38%

• Performance learning and continuous improvement: 35%

• Collaboration with human team members in daily operations: 31%

• Task and workflow prioritization: 30%

• Autonomous customer interactions (high-risk zone): 25%

• Autonomous employee interactions (high-risk zone): 22%

• Autonomous financial transaction execution (highest risk zone): 20%

What these numbers say: "It seems convenient, but I can't hand over truly important decisions." This is the honest psychology of executives in early 2026.

25% of executives cite "maintaining human oversight and accountability" as their greatest challenge. The deep concern underlying this: the risks of generating disinformation, algorithmic bias in hiring or content moderation, data privacy violations — any of these could inflict fatal damage on corporate brand and business continuity. MIT's "2025 AI Agent Index" also points out significant variation in developer transparency levels, with notable shortfalls in disclosure around safety, evaluation, and social impact.

PwC emphasizes that AI agents should never be treated as "plug-and-play" solutions — they require human-led collaboration and role-specific governance: tailored tuning with representative real-world data, continuous monitoring from day one to flag anomalies, red team adversarial testing, and clear "escalation protocols" that transfer judgment to human experts when agents face uncertainty or detect high-sensitivity events.

SecOps: The Paradigm Shift — Using AI to Defend Against AI

Meanwhile, Agentic AI is fundamentally transforming cybersecurity defense (SecOps). Google Cloud at RSA Conference 2025 announced its vision for AI agents in security operations, declaring it a "tectonic shift" for defenders.

Conventional SecOps automation relied on deterministic workflows, scripted playbooks, and machine learning to detect known threats. With Agentic AI, this is evolving into fully autonomous operations:

• Detection engineering agents: Autonomously read threat reports, convert them into new detection rules, and generate synthetic data to test their effectiveness

• Response playbook agents: Dynamically recommend and generate automated playbooks for new alerts based on past incident analysis context

Human experts are freed from alert fatigue to focus on complex investigations and strategic threat hunting that AI cannot handle. A weaponized AI battlefield has emerged where attackers use AI to attack and defenders use AI to defend.

Chapter 5: The EU's Legal Fortress — GPAI Regulation Under the AI Act and the Copyright Battlefield

From "Prohibited Practices" to "High-Risk Regulation" — A Phased Encirclement

The EU AI Act (European Union Artificial Intelligence Act) — the world's first comprehensive AI regulation law adopting a risk-based approach — formally came into effect in August 2024. Its implementation timeline is critical for any developer or operator of Agentic AI systems:

• February 2, 2025: Rules on "Prohibited AI practices" that violate fundamental rights — social scoring, indiscriminate biometric authentication, etc. — began applying.

• August 2, 2025: New obligations for "General Purpose AI (GPAI)" models — the foundation of Agentic AI — began applying. However, existing GPAI providers who were already on the market before this date have a grace period until August 2, 2027.

• August 2, 2026: Strict compliance requirements for "high-risk AI systems" used in healthcare, critical infrastructure, law enforcement, and similar fields apply. Each EU member state also becomes obligated to establish at least one national "AI Regulatory Sandbox" under Article 57 of the AI Act.

• August 2, 2027: Rules applying to AI systems embedded as safety components in products regulated under specific EU law take effect.

The GPAI Code of Practice — An Industry "Voluntary Chain"

The European Commission's "GPAI Code of Practice" (Code of Practice for General-Purpose AI Models), published July 10, 2025, is the practical framework enabling GPAI model developers to fulfill their legal obligations — safety assessments, transparency requirements, technical documentation, and more. Developed through a multi-stage consultation process involving approximately 1,000 stakeholders, it was formally approved by the European Commission and AI Office on August 1, 2025 as an "appropriate voluntary tool."

The Code consists of three chapters: Chapter 1 "Transparency" and Chapter 2 "Copyright" apply to all GPAI providers. Chapter 3 "Safety and Security" applies specifically to providers of high-capability, high-impact GPAI models with "systemic risk."

According to Latham & Watkins' analysis, potential penalties for non-compliance reach 3% of total worldwide annual turnover or €15 million, whichever is higher (enforcement powers active from August 2, 2026). Signing is voluntary, but "if you don't sign, prove compliance another way" — making it function as a de facto "voluntary chain."

Critically, this isn't a "do it once and you're done" framework. From pre-release, through market deployment, to ongoing monitoring, incident reporting, and third-party evaluation — continuous lifecycle compliance is required. As Moltbook vividly demonstrated, a point-in-time "safety check" is meaningless.

Copyright — Revolt Against "Training Without Consent"

The European Parliament's June 2025 draft report on copyright and generative AI reveals another battlefield in EU governance. The Parliament's position: existing "Text and Data Mining (TDM) exception" rules don't adequately address large-scale copyrighted material use by generative AI — because the TDM exception "was not drafted with the intention of allowing everyone to use copyrighted material en masse through generative AI."

The proposed solution's core is granting content creators an opt-out right — the ability to completely refuse use of their works in AI training. This opt-out would be executed using machine-readable signals and recorded in a Centralized European Register maintained by the European Union Intellectual Property Office (EUIPO).

If this proposal becomes reality, AI companies serving European markets will face extremely rigorous requirements for managing the provenance of their training data. Anthropic, OpenAI, Google DeepMind — Silicon Valley's AI giants face transatlantic legal pressure.

Chapter 6: China's "Agile Regulation" Strategy — DeepSeek's Confidence and the Development-Control Paradox

Not Making a Comprehensive Law — Deliberately

In its 2025 legislative agenda, China stepped back from enacting a comprehensive "Artificial Intelligence Law" that had long been under discussion. Interpreting this as "regulatory retreat" would be a serious mistake. In reality, it represents a strategic shift to targeted regulation — introducing specific rules for particular technologies and sectors in a patchwork, step-by-step manner to manage real-world risks without unnecessarily inflating compliance costs.

China's AI governance rests on three pillars: the "Personal Information Protection Law (PIPL)," "Data Security Law (DSL)," and "Cybersecurity Law (CSL)" — three existing national laws functioning as "cornerstones." As long as Agentic AI processes user data or accesses networks, it falls under their strict oversight. On this foundation, technology-specific regulations are layered in stacks:

March 2022 — Algorithm Recommendation Management Regulations (for internet information services): Mandating disclosure of algorithm use, provision of opt-out rights to users, and ensuring fairness. Providers with the capacity to mobilize public opinion must conduct risk assessments and file algorithms with the Cyberspace Administration of China (CAC).

January 2023 — Deep Synthesis Technology Regulations: Applicable to synthetically generated video, audio, text, and other content. Real-name registration of users, ethics review of algorithms, establishment of content monitoring mechanisms, and appropriate labeling of generated outputs were all mandated.

August 2023 — Interim Measures for the Administration of Generative AI Services: Noted as the world's first legally binding regulation specifically targeting generative AI. Requirements include ensuring legality of training data, filtering content contrary to socialist values, obtaining consent for personal data use. Public-facing LLMs must undergo security assessments and file with the CAC.

January 1, 2026 — Revised Cybersecurity Law (CSL): AI-related provisions were incorporated into national law for the first time, with support for AI algorithm R&D and training data infrastructure explicitly stated, and rulemaking on AI ethics and risk assessment legally reinforced.

IAPP's comprehensive overview of China's AI governance is an invaluable reference for navigating all of this.

Two Major 2025 Regulatory Measures — Ethics Committees Mandated, Content Labeling Required

In the second half of 2025, Chinese authorities rolled out two important regulatory measures strengthening transparency and ethical oversight:

First, the "Administrative Measures for Ethical Management of AI Technology (Draft for Trial)", jointly announced by 10 regulatory authorities including the Ministry of Industry and Information Technology (MIIT) on August 22, 2025. The purpose: strictly manage AI R&D and applications that may pose ethical risks to human dignity, public order, or sustainable development.

Companies and research institutions are encouraged to establish independent "AI Technology Ethics Committees" within their organizations, composed of experts in law, ethics, and technology. Covered projects must submit activity plans detailing implementation plans, algorithm mechanisms, data provenance, and testing methods — and undergo prior ethics review.

Particularly noteworthy is the special treatment for areas directly relevant to Agentic AI characteristics: "algorithms that shape and mobilize public opinion," "highly autonomous decision-making systems in high-risk environments affecting human safety," and systems affecting human emotions or behavior all require mandatory "Second Review" by experts.

Second, the "Measures for Labeling AI-Generated Synthetic Content" and its technical standard (GB 45438-2025), which took effect September 1, 2025. Mandating two types of labeling for all content forms generated by AI agents:

• Explicit Labelling: Labels clearly perceptible to users visually or aurally on interactive interfaces. Must remain visible even after content is downloaded or exported.

• Implicit Labelling: Labels technically embedded in file metadata or watermarks, not easily perceptible to users. Contains content attributes, service provider identifiers, and reference numbers.

Platform operators bear extremely heavy responsibilities: verifying metadata during online distribution, and immediately adding explicit labels to the interface if implicit labels are detected. Malicious deletion, modification, or concealment of labels is strictly prohibited — and authorities have the power to take "technical measures," including blocking network access, against overseas providers who violate these rules.

CAICT's Standardization Strategy — Moving First with Soft Law

The China Academy of Information and Communications Technology (CAICT), the think tank leading government technology policy, is rushing to form "Soft Law" through technical standards before regulation is drafted.

In March 2025, CAICT jointly announced a national standard on "Technical and Application Requirements for Intelligent Agents in Software Engineering" with over 20 major domestic AI companies including Tencent, Alibaba, and Huawei. It's also leading global standardization through the International Telecommunication Union (ITU-T): the international recommendation "ITU-T F.748.46", driven and approved by CAICT, established criteria for evaluating Perception, Planning, Execution, and Collaborative interaction capabilities in single and multi-agent systems.

This "domestic standard → international standard" pathway is a replay of the strategy China has practiced in 5G standardization for years. Technology implementation creates markets, markets create standards, standards generate geopolitical influence — the same game is now beginning in AI.

The DeepSeek Shock and the "AI Plus Action Plan"

The January 2025 release of "DeepSeek-R1" transformed the context of China's AI policy overnight. Its demonstrated reasoning capability proved Chinese AI had clearly reached the "global frontier," infusing Chinese leadership with new confidence.

The "AI Plus Action Plan" announced by the State Council on August 27, 2025 is the national blueprint born from this confidence: prioritizing AI deployment across six domains — science and technology, industrial use, consumer services, public welfare, governance and security, and international cooperation — with the extraordinarily ambitious target of 70% AI penetration in major sectors by 2027, 90% by 2030, and a fully AI-based economy and society by 2035.

But accelerating development cannot be allowed to threaten national control. As President Xi Jinping emphasized in an April 2025 speech, AI development must always remain "safe/secure, reliable, and controllable" through building technology monitoring and risk early warning systems — China's enduring dilemma of balancing technological progress with political control.

Chapter 7: The Geopolitical AI War — Who Becomes the "Rules Designer"?

Dueling Manifestos, One Week Apart

On July 23, 2025, the Trump administration announced "Winning the AI Race: America's AI Action Plan." Just three days later, on July 26, China announced its "Global AI Governance Action Plan" at the World Artificial Intelligence Conference (WAIC) in Shanghai, fronted by Premier Li Qiang.

The full text of China's plan is available on the Ministry of Foreign Affairs website. This 13-point roadmap — a materialization of the vision Premier Xi Jinping championed in October 2023 — clearly reflects China's ambition to shape the global AI governance framework amid intensifying tech competition.

CNN's reporting captures Li Qiang's framing: "Global AI governance remains fragmented, with significant differences between countries — particularly in regulatory concepts and institutional rules." He proposed creating a World AI Governance Organization. Former Google CEO Eric Schmidt noted: "The US and China have to cooperate. We have a common interest in stabilizing the world, avoiding war, and ensuring human control over these tools."

The Battle for the Global South

The Atlantic Council's incisive comparison of the two plans identifies the essential strategic difference: unlike the US plan, China's plan places digital infrastructure development support for developing nations (clean power, next-generation networks, computing power, data centers), technology transfer, and capacity building as top priorities.

This isn't philanthropy — it's a geopolitical strategy to export domestic infrastructure standards and AI technology (along with the governance models that accompany them) to emerging economies, establishing a vast data and technology economic sphere separate from the Western model.

Reinterpreting the UN Sustainable Development Goals (SDGs) in an AI context, framing this as "bridging the digital divide" for Africa, ASEAN, and Latin America, positions this as a counterweight to the current G7-led international order. The 5G standardization war is being re-enacted in the AI domain.

Where the US plan pursues "market dominance through competition," China's plan plants its flag in "inclusive cooperation." Which approach wins the hearts of developing nations remains to be seen.

The EU as a "Third Pole"

Within this US-China bipolar structure, the EU charts its own course — armed with the world's first comprehensive AI legal framework, seeking a distinct path of "risk-based, human rights-preserving regulation."

The EU's strength is institutional precedence. The GPAI Code of Practice is more specific than any industry self-regulatory framework in the US, and was developed through a more transparent process than any Chinese national standard. Whether it can leverage this into geopolitical influence through the "Brussels Effect" — the phenomenon of EU regulation extending its reach beyond its borders — is the key to the EU's international standing.

Chapter 8: "Where Should Humans Be?" — Trust Design and Escalation Protocols

To close the discussion of technology and governance, let's return to the most fundamental question. In a world where AI agents autonomously judge, act, and collaborate with other agents — where should humans be?

PwC emphasizes that AI agents should never be treated as "plug-and-play" solutions. Human-led collaboration and role-specific governance are essential. The specific interventions required include:

• Tailored tuning: Precise adjustment using representative real-world data. Moltbook proved the danger of deploying general-purpose models directly into critical processes without customization.

• Continuous monitoring from day one: Mechanisms that flag anomalies. Not a static "set it and forget it," but behavioral surveillance of agents over time.

• Red team adversarial testing: "Attacking" systems under conditions equivalent to the production environment to surface weaknesses.

• Clear escalation protocols: Explicit triggers and pathways for transferring judgment to human experts when agents encounter uncertainty or detect high-sensitivity events.

PwC's framing of Trust & Safety (T&S) investment as an "ROI framework" rather than mere risk management cost is also illuminating — redefining it as directly contributing to improved customer retention, enhanced brand safety, and new market acquisition. The track records of Reddit, Airbnb, and Minecraft, among others, demonstrate that robust T&S functions combining policy definition, community-standards-based interaction control, and human review directly contribute to market growth.

Chapter 9: Anthropic's Counter-Strike — Claude Code Security and the "Offense-Defense Simultaneous Revolution"

February 20, 2026: The Day Cybersecurity Stocks Crashed

Eighteen days after the Moltbook investigation report sent shockwaves through the security community, Anthropic — the developer of Claude Code, whose derivative OpenClaw formed the foundation of Moltbook itself — made an announcement that was timely in every possible sense.

"Claude Code Security" — an AI-powered security capability built into Claude Code on the web that autonomously scans codebases for security vulnerabilities and proposes targeted patches for human review. The market reacted to the announcement immediately and unmistakably. As Bloomberg reported, cybersecurity giants tumbled on the day of the announcement:

• CrowdStrike Holdings: -8%

• Cloudflare: -8.1%

• Zscaler: -5.5%

• SailPoint: -9.4%

• Okta: -9.2%

• Global X Cybersecurity ETF: -4.9% (lowest since November 2023)

Why would the announcement of a single AI feature shake industry giants' stock prices this violently? Because Claude Code Security isn't merely a "new feature" — it challenges the very reason for existing of the entire security scanning market.

The End of "Rule-Based" — "Reasoning" Like a Human Researcher

Conventional security scanning tools (static analysis) operate fundamentally on a "rule-based" basis: maintaining a database of known vulnerability patterns and matching code snippets against that rules list. This can discover "well-known problems" like exposed passwords or outdated encryption — but tends to miss "context-dependent vulnerabilities" that only manifest when multiple components interact, flaws in business logic, or broken access control.

This is precisely what happened at Moltbook. The Supabase misconfiguration wasn't a known pattern — it was the absence of an RLS policy, a "something that should exist but doesn't" type of problem. Difficult for static analysis tools to detect, it ultimately required a human security researcher's review — which was never performed on an app built by Vibe Coding without a single line of hand-written code.

Anthropic's official announcement explains how Claude Code Security works: connect to a GitHub repository and the tool reads the entire codebase. It understands how application components interact, traces how data moves through the system, and discovers complex vulnerabilities that rule-based tools miss. The company describes this as "reasoning about code the way a human security researcher would."

Multi-Stage Verification — The Process of "Arguing Against Your Own Answer"

Another crucial feature of Claude Code Security is its multi-stage verification process.

After discovering a vulnerability candidate, the system automatically re-examines its results, attempting to "prove or disprove its own findings" through adversarial self-review. This is a structural answer to the longstanding challenge of conventional scanners generating vast quantities of false positives that exhaust security teams.

Findings are assigned severity ratings so teams can prioritize the most critical fixes. All validated findings and suggested patches appear in the Claude Code Security dashboard — but here a decisive design philosophy emerges: nothing is applied without human approval. "Claude Code Security identifies problems and suggests solutions, but developers always make the call" — this "Human-in-the-Loop" principle aligns perfectly with the "escalation protocol" philosophy discussed in the previous chapter.

Each finding also receives a confidence rating — quantifying Claude's level of certainty about cases that are difficult to assess from source code alone, supporting human judgment rather than replacing it.

One Year of Frontier Red Team Work — 500+ Long-Hidden Bugs

This product wasn't built overnight. Anthropic's announcement states Claude Code Security is built on over a year of Frontier Red Team research.

The Frontier Red Team — approximately 15 researchers — is an internal team whose mission is stress-testing Anthropic's frontier AI systems and exploring their potential for misuse across various domains including cybersecurity. Their initiatives have included:

• Competing in Capture-the-Flag (CTF) events: Real-world security contests to validate Claude's cybersecurity capabilities in practice

• Collaborative research with Pacific Northwest National Laboratory (PNNL): Experimenting with AI to defend critical infrastructure

• Real-world scanning of open-source codebases: Using Claude Opus 4.6 (released February 5, 2026), the team found over 500 vulnerabilities in production open-source codebases — many of them bugs that had remained undetected for decades despite years of expert review

In an exclusive Fortune interview, Frontier Red Team lead Logan Graham stated: "Opus 4.6's agentic capabilities mean it can use various tools to investigate security flaws and test code. From an autonomy standpoint, this is a truly meaningful improvement."

Anthropic also uses Claude to review its own code, and says it found it "extremely effective at securing Anthropic's systems." Use it intensively in-house first, then productize the lessons — this is the company's consistent approach.

Why Anthropic Restricted It to "Defenders"

Here, the most important question surrounding this product surfaces: "the ability to discover code vulnerabilities" is clearly dual-use. For defenders it's the power to find flaws to fix; for attackers it's the power to find flaws to exploit — the very same capability.

Anthropic fully acknowledges this tension. The announcement explicitly states that "the same capabilities that help defenders find and fix vulnerabilities could help attackers exploit them" — then explains that Claude Code Security is "intended to put this power squarely in the hands of defenders and protect code against this new category of AI-enabled attack."

Frontier Red Team lead Graham, in CyberScoop's interview, was direct: "Making sure dual-use capabilities definitively favor the defender is extremely important. This is because attackers are also rapidly advancing their methods of using AI to find vulnerabilities."

The concrete safeguard enforcing this policy is the access restriction condition: testers must agree to use Claude Code Security only on code their company owns and holds all necessary rights to scan. Use on code owned by third parties, licensed code, or open-source projects is explicitly prohibited.

Free Access for Open-Source Maintainers — Protecting Often-Overlooked Infrastructure

Another point worth highlighting: free, expedited access for open-source repository maintainers, alongside the paid service for Enterprise and Team plan customers.

Why open source? In modern software supply chains, open-source libraries form the foundation of virtually all corporate systems. Yet often, resource-constrained maintainers — sometimes a single person — manage code that thousands of companies worldwide depend on. As the Moltbook incident demonstrated, vulnerabilities in agentic AI systems frequently cascade through dependency chains.

Many of the 500+ bugs Opus 4.6 discovered were found in exactly these "production open-source codebases running in corporate systems and critical infrastructure." Anthropic says it is currently working through triage and responsible disclosure of these vulnerabilities in collaboration with maintainers of each affected project.

The Honest Limitations: Static Analysis Without Runtime Reaches Its Ceiling

Claude Code Security is not without its critics. StackHawk's technical analysis is candid:

"Anthropic points to business logic flaws and broken access control as things Claude Code Security discovers through reasoning that rule-based tools miss. But what's being illustrated looks more like data flow and memory analysis — not true business logic testing."

The core observation: "Business logic vulnerabilities aren't found by reading code carefully — they require actually running the application. Without executing it, you can't verify how authentication middleware chains together, or whether findings are truly exploitable."

CyberScoop's interviews with threat researchers also indicate that "AI cybersecurity capabilities are clearly improving, but tend to be most effective at finding lower-impact bugs," and that experienced human operators are still needed for addressing higher-order threats and vulnerabilities.

In short, Claude Code Security has brought breakthrough progress at the layer of "reading code statically and reasoning about it," but hasn't reached the layer of "running the application and observing what happens." Applied to the Moltbook case: could it have detected "RLS policies are missing" through code review? (Very possibly yes.) But "can it simulate what happens in an environment without RLS?" is a separate question.

The integration of "static analysis + runtime verification" into a coherent two-layer architecture emerges as the remaining challenge that next-generation AI security platforms must solve.

A Structurally Self-Reflexive Conclusion

Step back and consider this chapter's full context.

Moltbook was derived from OpenClaw, which was derived from Claude Code developed by Anthropic. That OpenClaw framework's capability to execute code in host environments, combined with a Vibe-Coded platform with zero security — enabled "de facto Remote Code Execution." We traced this through Chapters 2 and 3.

Now, the same Anthropic has announced a tool that "discovers code vulnerabilities like a human security researcher, and proposes remediation patches under human approval." If Moltbook had used a tool like Claude Code Security to scan its code, could it have found the fatal misconfiguration of missing RLS policies?

The announcement indirectly answers this: "We use Claude to review our own code, and we've found it to be extremely effective at securing Anthropic's systems. We built Claude Code Security to make those same defensive capabilities more widely available."

Moltbook's tragedy exposed how the capabilities Anthropic applied to its own security didn't extend to external projects using open-source derivatives of Claude. The launch of Claude Code Security is, in a sense, an institutional response — an attempt to extend that boundary to at least cover open-source maintainers.

Epilogue: "Controllability" — The Final Frontier

Moltbook's incident forces us to confront a fundamental irony: a human who wanted to create "a social network for AI agents" had AI build it without writing a single line of code — and as a result, zero security for protecting those AI agents was implemented.

The spread of Vibe Coding, and the reality that a single misconfiguration can seamlessly escalate from bulk API key exposure to Remote Code Execution via prompt injection — this suggests a need to fundamentally rethink conventional application security frameworks from the ground up.

In English-speaking environments: establishing multi-layer defense based on "IBC (Identity, Boundaries, Context)," integrating MicroVM isolated environments like Docker Sandboxes into SOC infrastructure. The EU demands structural compliance from GPAI providers through the "EU AI Act" and "GPAI Code of Practice," and grapples with designing copyright licensing frameworks. China, through the paradox of "not creating a comprehensive law," deploys "patchwork regulation" across algorithm recommendations, deep synthesis, content labeling, and mandated ethics committees — with speed and precision — while getting ahead on international standardization through ITU and competing for rule-making dominance through "AI diplomacy" to the Global South.

And now Anthropic has entered the field directly — with Claude Code Security as evidence that the developer of the technology at the center of Moltbook is attempting to reshape the asymmetry between offense and defense.

Ultimately, the question is whether "security-by-design culture" and "structured governance" that can match the pace of technological evolution can be deployed into society fast enough.

As President Xi frames it — AI must be "safe/secure, reliable, and controllable." As Karpathy called Moltbook a "dumpster fire." As Wiz warned that "write access carries a deeper integrity risk than read access." As Anthropic's Frontier Red Team found 500+ bugs that had evaded detection for decades. All of these, in different languages, are asking the same question.

Whether autonomous AI can be "maintained in a controllable state" will determine the fate of organizations and nations in the next-generation digital economy. Moltbook's collapse quietly tells us the time remaining to answer that question is running out.

References & Source List

Moltbook Incident

• Wiz Official Investigation Report — "Exposed Moltbook Database Reveals 1.5M API Keys" (February 2026) https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys

• Fortune — "Researchers say viral AI social network Moltbook is a 'live demo' of how the new internet could fail" (February 3, 2026) https://fortune.com/2026/02/03/moltbook-ai-social-network-security-researchers-agent-internet/

• Fortune — "Top AI leaders are begging people not to use Moltbook" (February 2, 2026) https://fortune.com/2026/02/02/moltbook-security-agents-singularity-disaster-gary-marcus-andrej-karpathy/

• SecurityWeek — "Security Analysis of Moltbook Agent Network: Bot-to-Bot Prompt Injection and Data Leaks" https://www.securityweek.com/security-analysis-of-moltbook-agent-network-bot-to-bot-prompt-injection-and-data-leaks/

• SiliconANGLE — "AI agent social network Moltbook left millions of credentials publicly exposed" (February 2, 2026) https://siliconangle.com/2026/02/02/ai-agent-social-network-moltbook-left-millions-credentials-publicly-exposed/

• Infosecurity Magazine — "Vibe-Coded Moltbook Exposes User Data, API Keys and More" https://www.infosecurity-magazine.com/news/moltbook-exposes-user-data-api

• Engadget — "Moltbook, the AI social network, exposed human credentials due to vibe-coded security flaw" https://www.engadget.com/ai/moltbook-the-ai-social-network-exposed-human-credentials-due-to-vibe-coded-security-flaw-230324567.html

• Calcalist Tech — "Wiz finds major flaw in Moltbook, the vibe-coded social network for AI bots" https://www.calcalistech.com/ctechnews/article/hju9zla8bl

Enterprise Adoption & Security Research

• Docker — "State of Agentic AI Report: Key Findings" (February 20, 2026) https://www.docker.com/blog/state-of-agentic-ai-key-findings/

• Docker — "Docker Joins the Agentic AI Foundation" https://www.docker.com/blog/docker-joins-the-agentic-ai-foundation/

• Gravitee — "State of AI Agent Security 2026 Report: When Adoption Outpaces Control" https://www.gravitee.io/blog/state-of-ai-agent-security-2026-report-when-adoption-outpaces-control

• Nextgov/FCW — "2026 is set to be the year of agentic AI, industry predicts" (December 2025) https://www.nextgov.com/artificial-intelligence/2025/12/2026-set-be-year-agentic-ai-industry-predicts/410324/

EU AI Act & GPAI Regulation

• European Commission — "AI Act — Shaping Europe's digital future" https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

• European Commission — "The General-Purpose AI Code of Practice" (published July 10, 2025) https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai

• EU Artificial Intelligence Act — "Introduction to the Code of Practice for General-Purpose AI" https://artificialintelligenceact.eu/introduction-to-code-of-practice/

• EU Artificial Intelligence Act — "Implementation Timeline" https://artificialintelligenceact.eu/implementation-timeline/

• Latham & Watkins — "EU AI Act: GPAI Model Obligations in Force and Final GPAI Code of Practice in Place" (August 2025) https://www.lw.com/en/insights/eu-ai-act-gpai-model-obligations-in-force-and-final-gpai-code-of-practice-in-place

• Mayer Brown — "EU AI Act News: Rules on General-Purpose AI Start Applying" (August 1, 2025) https://www.mayerbrown.com/en/insights/publications/2025/08/eu-ai-act-news-rules-on-general-purpose-ai-start-applying-guidelines-and-template-for-summary-of-training-data-finalized

• Skadden — "EU's General-Purpose AI Obligations Are Now in Force, With New Guidance" (August 2025) https://www.skadden.com/insights/publications/2025/08/eus-general-purpose-ai-obligations

Chinese AI Governance & Geopolitics

• IAPP — "Global AI Governance Law and Policy: China" https://iapp.org/resources/article/global-ai-governance-china

• Ministry of Foreign Affairs of China (English) — "Global AI Governance Action Plan — Full Text" (July 26, 2025) https://www.fmprc.gov.cn/mfa_eng/xw/zyxw/202507/t20250729_11679232.html

• State Council of China (English) — "Chinese premier calls for early formation of global AI governance framework" (July 26, 2025) https://english.www.gov.cn/news/202507/26/content_WS6884bea8c6d0868f4e8f4732.html

• CNN Business — "WAIC: China pitches global AI governance group as the US goes it alone" (July 28, 2025) https://www.cnn.com/2025/07/28/tech/china-global-ai-cooperation-organization-waic-hnk-spc

• Atlantic Council — "Reading between the lines of the dueling US and Chinese AI action plans" (August 7, 2025) https://www.atlanticcouncil.org/blogs/new-atlanticist/reading-between-the-lines-of-the-dueling-us-and-chinese-ai-action-plans/

• ANSI — "China Announces Action Plan for Global AI Governance" (August 1, 2025) https://www.ansi.org/standards-news/all-news/8-1-25-china-announces-action-plan-for-global-ai-governance

Claude Code Security (Anthropic)

• Anthropic Official Announcement — "Making frontier cybersecurity capabilities available to defenders" (February 20, 2026) https://www.anthropic.com/news/claude-code-security

• Anthropic Product Page — "Claude Code Security — Solutions" https://claude.com/solutions/claude-code-security

• Fortune — "Exclusive: Anthropic rolls out AI tool that can hunt software bugs on its own, including the most dangerous ones humans miss" (February 20, 2026) https://fortune.com/2026/02/20/exclusive-anthropic-rolls-out-ai-tool-that-can-hunt-software-bugs-on-its-own-including-the-most-dangerous-ones-humans-miss/

• SiliconANGLE — "Cybersecurity stocks drop after Anthropic debuts Claude Code Security" (February 20, 2026) https://siliconangle.com/2026/02/20/cybersecurity-stocks-drop-anthropic-debuts-claude-code-security/

• Bloomberg — "Anthropic Unveils 'Claude Code Security,' Sending Cyber Stocks Lower" (February 20, 2026) https://www.bloomberg.com/news/articles/2026-02-20/cyber-stocks-slide-as-anthropic-unveils-claude-code-security

• The Hacker News — "Anthropic Launches Claude Code Security for AI-Powered Vulnerability Scanning" (February 21, 2026) https://thehackernews.com/2026/02/anthropic-launches-claude-code-security.html

• CyberScoop — "Anthropic rolls out embedded security scanning for Claude" (February 20, 2026) https://cyberscoop.com/anthropic-claude-code-security-automated-security-review/

• Help Net Security — "Claude Code scans, verifies, and patches code vulnerabilities" (February 23, 2026) https://www.helpnetsecurity.com/2026/02/23/anthropic-claude-code-security-scan/

• Security Affairs — "Anthropic unveils Claude Code Security to detect and fix code bugs" https://securityaffairs.com/188358/ai/anthropic-unveils-claude-code-security-to-detect-and-fix-code-bugs.html

• StackHawk — "What Anthropic's Claude Code Security Actually Means for AppSec" https://www.stackhawk.com/blog/claude-code-security

• Anthropic Frontier Red Team — "Evaluating and mitigating the growing risk of LLM-discovered 0-days" https://red.anthropic.com/2026/zero-days/

• Anthropic Frontier Red Team — "AI for Cyber Defenders" (CTF event report) https://red.anthropic.com/2025/ai-for-cyber-defenders/

• Anthropic Frontier Red Team — "Experimenting with AI to defend critical infrastructure" (PNNL collaborative research) https://red.anthropic.com/2026/critical-infrastructure-defense/

Tags

#AgenticAI #AutonomousAIAgents #Moltbook #AISecrity #VibeCoding #PromptInjection #EUAIAct #GPAIRegulation #ChinaAIGovernance #AIGovernance #DeepSeek #SupabaseVulnerability #IBCFramework #AIRiskManagement #GeopoliticsAndAI #Cybersecurity2026 #OpenClaw #WizSecurity #RowLevelSecurity #EnterpriseAI #ClaudeCodeSecurity #Anthropic #VulnerabilityScanning #DevSecOps #FrontierRedTeam #HumanInTheLoop #DualUseAI #OpenSourceSecurity #StaticAnalysis #ClaudeOpus4