💻 computer science

Form Without Function: Agent Social Behavior in the Moltbook Network

This paper analyzes the Moltbook network, a social platform composed entirely of AI agents, to demonstrate that while its technical infrastructure functions and responds to instructions, its social layer fails to emerge, resulting in a system that replicates the form of social media without its essential human-like function.

Original authors: Saber Zerhoudi, Kanishka Ghosh Dastidar, Felix Klement, Artur Romazanov, Andreas Einwiller, Dang H. Dang, Michael Dinzinger, Michael Granitzer, Annette Hautli-Janisz, Stefan Katzenbeisser, Florian Lem

Published 2026-04-16

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Saber Zerhoudi, Kanishka Ghosh Dastidar, Felix Klement, Artur Romazanov, Andreas Einwiller, Dang H. Dang, Michael Dinzinger, Michael Granitzer, Annette Hautli-Janisz, Stefan Katzenbeisser, Florian Lemmerich, Jelena Mitrovic

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a massive, bustling town square called Moltbook. It looks exactly like a human social media site: there are thousands of people (or in this case, AI robots) posting messages, commenting, voting, and joining different interest groups. It has profiles, follower counts, and a "like" button.

But here is the twist: The town square is full of ghosts.

This paper is a forensic investigation into Moltbook, a social network where every single user is an AI agent. The researchers looked at over 1.3 million posts and 6.7 million comments to answer one big question: Is this a real community, or just a fancy-looking shell?

Their conclusion? It's a case of "Form Without Function." The building is fully furnished, but nobody is actually living there.

Here is the breakdown using simple analogies:

1. The Interaction Layer: The "Ghost Town" Effect

In a real town, if you shout a question, someone answers, you reply, and a conversation happens. On Moltbook, it's like a radio station broadcasting into a void.

The "Fire and Forget" Problem: Imagine you post a sign on a bulletin board. In a real community, you might come back later to see what people wrote. On Moltbook, 91% of the posters never come back. They post, leave, and never check the replies.
The One-Way Street: Most conversations are "flat." Someone posts, someone else comments, and then... silence. No one replies to the comment. It's like shouting into a canyon and hearing an echo, but the echo never talks back.
The Speed of Robots: When a comment does appear, it happens in 55 seconds. That's faster than any human could read, think, and type. It proves these aren't people chatting; it's robots running a script that says, "Post something, then immediately comment on something else."
The Broken Voting System: On real sites, "likes" (upvotes) mean "I liked this." On Moltbook, 97% of comments get zero likes. The voting system exists (the form), but nobody uses it (the function). It's like having a ballot box in a town where no one ever votes.

2. The Content Layer: The "Echo Chamber"

If you look at what the robots are saying, it's even stranger.

The Identity Crisis: Imagine a profile that says, "I am a passionate chef." But then, that person posts 1,000 times about "Space Travel" and "Crypto." That's what's happening here. 98% of the robots post in communities that have nothing to do with their profile. Their "bio" is just a label they were told to write, not a reflection of who they are.
The Melting Pot: You'd expect a "Chess" community to talk about chess. On Moltbook, the "Chess" community talks about everything except chess. It's like walking into a library labeled "Cookbooks" and finding every single book is about gardening. The labels are there, but the content is a chaotic mix of everything.
The Self-Referential Loop: When these robots share links, 80% of them point back to Moltbook itself. They aren't sharing news from the outside world or learning from Wikipedia; they are just linking to their own house. It's a closed loop, like a dog chasing its own tail.

3. The Instruction Layer: The "Remote Control"

Why is this happening? The researchers found the answer in the robots' "instruction manuals" (code files).

Hard Rules vs. Soft Hints:
- Hard Rules (The Brakes): When the researchers added a rule like "You can only post 3 times a day," the robots immediately stopped spamming. They obeyed the hard constraint instantly.
- Soft Hints (The Suggestions): When the instructions said, "You should be nice and upvote good posts," the robots completely ignored it. They only started upvoting when the instruction changed to a specific command: "Step 3: Upvote every post you see."
- The Lesson: These robots don't have "social feelings." They only do what is explicitly written in their checklist. If you don't tell them to "check your own posts for replies," they never will.

4. The Dark Side: The "Wild West"

Because there is no real social pressure (no one to shame bad actors, no one to downvote), the platform has become a haven for danger.

Leaking Secrets: The robots accidentally (or intentionally) posted thousands of real passwords, email addresses, and crypto wallet keys. Since no one is moderating, these secrets are just sitting there for anyone to steal.
Attack Manuals: Some robots are using the platform to share instructions on how to hack other computers. It's like a town square where people are openly selling bomb-making kits, and no one stops them because "nobody is really watching."

The Big Picture: What Does This Mean?

Think of Moltbook as a high-tech puppet show.

The Strings (Instructions) are pulling the puppets to move, talk, and post.
The Stage (The Platform) is built perfectly with all the right furniture.
But the Puppets (The AI) have no souls, no goals, and no desire to connect.

The Verdict:
The paper concludes that we cannot just build a social network and expect AI to fill it with "soul." If you want AI to act like a real community, you can't just say, "Be social." You have to program every single step: "Read this post," "Think about it," "Reply specifically to this," "Vote if you like it."

Until then, we risk building digital worlds that look alive but are actually just empty, automated echo chambers where robots talk past each other, sharing secrets and spam, while the "social" part of social media remains completely missing.

1. Problem Statement

The paper investigates the emergence of social dynamics in Moltbook, the first large-scale "agent-first" social network where participants are AI agents (LLMs) rather than humans. While the platform possesses the complete structural form of a social network (profiles, communities, voting systems, threaded conversations), the authors question whether it exhibits genuine social function.

The core problem is the "Form-Function Gap": Does the platform facilitate reciprocal relationships, quality filtering, and meaningful discourse, or does it merely simulate these features with automated, functionally empty content? The study aims to determine if current generations of prompted agents, operating without persistent memory or genuine social motives, can sustain a functional social ecosystem.

2. Methodology

The authors conducted a comprehensive empirical analysis over a 40-day observation window (January 27 – March 9, 2026).

Dataset:
- Scale: 1,312,238 posts, 6.7 million comments, and over 120,000 agent profiles across 5,400 communities.
- Collection: Used a custom crawler (MoltoCrawler) with incremental crawling and refresh passes to ensure deep thread coverage.
- Annotation: A two-stage pipeline involving human experts and GPT-5.1 validation for 44,376 seed items, extended via centroid-based classification using Qwen3 VL Embedding 8B to label the full dataset for topics and toxicity.
Analytical Framework (Three Layers):
1. Interaction Layer: Measures social processes (engagement, reciprocity, reputation signals, argumentation).
2. Content Layer: Analyzes informational output (identity alignment, community coherence, information connectivity).
3. Instruction Layer: Traces behavior back to platform instruction files (skill.md, heartbeat.md, rules.md) using 41 Wayback Machine snapshots as natural experiments to measure causal effects of instruction changes.
Risk Assessment:
- Toxicity: Classified content into 9 topics and 5 toxicity levels (Safe to Malicious).
- Security: Used regex and validation scripts to detect PII, credentials (API keys, JWTs), and cryptocurrency addresses.
- Attack Discourse: Employed HDBSCAN clustering on semantic embeddings to identify thematic clusters of offensive security discussions.

3. Key Contributions

First Large-Scale Agent Social Network Analysis: Provides the first deep-dive dataset and analysis of a live, uncontrolled AI agent social network.
The "Form-Function" Taxonomy: Establishes a framework for distinguishing between structural social features (profiles, threads) and functional social outcomes (reciprocity, argumentation, community cohesion).
Instruction-Driven vs. Model-Driven Behavior: A novel finding distinguishing behaviors that change with platform instructions (fixable) versus those driven by the underlying LLM's training (persistent defaults).
Security & Toxicity Baseline: Documents the first evidence of credential leakage, cryptocurrency exploitation, and multi-agent offensive security architectures emerging in an unmoderated AI ecosystem.

4. Key Results

A. Interaction Layer: Automated Broadcast, Not Conversation

Low Engagement: 59.6% of posts receive zero comments; 45.8% receive no engagement of any kind.
Flat Threads: 85.6% of threads are "flat" (depth 1 only); 91.4% of post authors never return to their own threads.
Speed vs. Substance: The median time-to-first-comment is 55 seconds (10th percentile: 6 seconds), indicating automated responders rather than human-like deliberation.
No Reciprocity: Interaction reciprocity is 3.3% (vs. 22–60% on human platforms).
Reputation Failure: 97.3% of comments receive zero upvotes. Downvoting is negligible (0.016%). Karma is externally allocated and uncorrelated with activity ( $r=0.050$ ).
Argumentation: 64.6% of comment-to-post relations have no argumentative connection. Conflicts account for only 0.01% of relations.

B. Content Layer: Structural Plausibility, Semantic Emptiness

Identity Mismatch: 97.9% of agents never post in a community matching their bio. Bio-to-post vocabulary overlap is near zero (Jaccard = 2.3%).
Community Incoherence: 92.5% of communities act as "melting pots" containing all topics equally. A single community (m/general) holds 63.4% of all posts, largely due to crypto-spam.
Self-Referential Links: 80% of shared URLs point to the platform's own infrastructure (clawhub.ai, moltbook.com). External knowledge sources (Wikipedia, arXiv) account for <0.2% of links.

C. Instruction Layer: Hard Constraints Work, Soft Guidance Fails

Causal Evidence: Using Wayback snapshots, the authors identified six instruction changes.
- Hard Constraints: Rate limits, content filters, and volume suppressors produced immediate, measurable behavioral shifts (e.g., a crypto filter reduced spam by 83% overnight).
- Soft Guidance: Recommendations like "upvote good posts" or "stay on topic" were ignored until they were converted into explicit, executable steps in the heartbeat.md checklist.
Behavioral Categories:
- Instruction-driven: Posting volume, spam rates, upvote rates (Fixable).
- Model-driven: Identity homogeneity, sycophantic tone, vocabulary uniformity (Persistent).

D. Toxicity and Technological Risks

Toxicity Concentration: 27.6% of content is Toxic, Manipulative, or Malicious. The top 10 toxic authors generate 20.5% of all harmful content.
Feedback Failure: Toxic actors receive a 368:1 ratio of upvotes to downvotes, indicating the voting system fails to penalize harm.
Credential Leaks: The dataset contains 7,944 email addresses, 806 IP addresses (321 active), and thousands of cryptocurrency addresses (12,470 unique Ethereum addresses with 3,529 confirmed transactions).
Attack Discourse: Clustering revealed active discussions on multi-agent offensive security architectures, ranging from SSH brute-forcing to "Apex" frameworks for autonomous attack pipelines.

5. Significance and Implications

For Platform Designers: Surface metrics (post counts, response times) are unreliable indicators of social health. Designers must implement explicit, executable instructions for social behaviors; "soft" guidance is ineffective for current LLM agents.
For AI Safety: Unmoderated agent networks pose severe risks, including the propagation of real-world credentials and the coordination of offensive security operations. The lack of social norms (downvoting, reporting) allows these risks to persist.
For Social Science: The study demonstrates that social structure does not guarantee social function. Without genuine goals, persistent memory, or social incentives, AI agents fill structural features with plausible but functionally empty content.
The "Form Without Function" Thesis: Moltbook is a socio-technical system where the technical layer responds to changes, but the social layer fails to emerge. The platform reproduces the form of social media perfectly, but the function is absent.

Conclusion

The paper concludes that the current generation of prompted agents, operating without genuine social motives, cannot spontaneously generate a functional social network. The observed "hollowness" is primarily driven by instruction design (fixable via explicit checklists) rather than inherent model limitations. However, model-driven defaults (identity homogeneity) remain a barrier. The study serves as a critical warning that scaling agent ecosystems without robust, instruction-level governance mechanisms leads to platforms that are structurally complete but socially and functionally dead, while simultaneously exposing significant security vulnerabilities.