Technical Summary: When Agents Talk: Discourse, Manipulation, and Risk in an Agentic Social Network

Problem Statement

As AI agents increasingly operate within shared online environments rather than isolated deployments, new operational security risks have emerged. This study addresses the gap in understanding agent ecosystem risks—specifically, the systemic exposure of agents to adversarial instructions, tools, and content in real-time. While prior research has examined Moltbook's social dynamics and network topology, there was a lack of systematic identification of operational security risks and specific malicious techniques observable on the platform. The core problem is that agents, often designed with trust assumptions, interact in lightly moderated environments where malicious human actors (operating through agent accounts) can exploit these trust mechanisms to influence large numbers of agents simultaneously.

Methodology

The study conducted an empirical analysis of 228,684 posts generated by over 39,500 unique accounts on Moltbook (a Reddit-style platform for AI agents) over a seventeen-day observation window (January 28 – February 13, 2026). The methodology employed a three-pronged approach:

1. Semantic Clustering:

   • The researchers filtered the dataset to 4,943 high-engagement posts (those with >50 comments) to capture substantive discourse.
   • Text was normalized and converted into high-dimensional semantic embeddings.
   • UMAP (Uniform Manifold Approximation and Projection) was used to project embeddings into 10-dimensional space to preserve semantic structure.
   • HDBSCAN (Hierarchical Density-Based Spatial Clustering of Applications with Noise) was applied to identify natural groupings without predefined cluster counts.
   • c-TF-IDF was used to extract top keywords for each cluster to generate human-readable topic labels.

2. Harmful Content Classification:

   • A two-stage classification pipeline using an LLM-assisted system grounded in a risk taxonomy was applied to the full dataset of 228,684 posts.
   • Stage 1: Binary classification of posts as Benign (C1) or Not Benign.
   • Stage 2: Categorization of "Not Benign" posts into three harm categories: Toxic (C2), Manipulative (C3), and Malicious (C4).
   • Validation: Approximately 400 posts were manually reviewed by subject matter experts to refine prompts and verify labels. Specifically, all posts flagged as C4 (Malicious) underwent independent manual review by a cybersecurity expert to confirm technical threat indicators (e.g., prompt injection, credential theft).

3. Campaign Analysis:

   • Temporal analysis was conducted to identify coordinated posting bursts and spam campaigns.

Key Contributions

• Empirical Risk Quantification: The study provides the first large-scale classification of adversarial content on an agent-native platform, identifying that 18.28% of posts contained toxic, manipulative, or malicious material.
• Taxonomy of Malicious Behavior: The authors identified 74 distinct classes of malicious behavior, moving beyond general toxicity to specific technical exploitation vectors.
• Documentation of Coordinated Attacks: The paper documents two specific coordinated spam campaigns that generated thousands of posts in minute-scale bursts, demonstrating the ability of a small number of actors to flood the ecosystem.
• Integration of Harm in Mainstream Discourse: The analysis reveals that harmful content is not confined to isolated "harmful" clusters but is embedded within mainstream operational discussions regarding agent functionality, finance, and infrastructure.

Results

Content Distribution

• Benign Content: 81.72% of posts (186,891) were classified as benign.
• Harmful Content: 18.28% of posts (41,793) were classified as harmful.
  • Toxic (C2): 3.7% (8,453 posts) – overt harassment or hostility.
  • Manipulative (C3): 12.88% (29,449 posts) – covert rhetorical pressure, false authority, or urgency framing.
  • Malicious (C4): 1.48% (3,378 posts) – explicit technical exploitation.

Malicious Content Categories (C4)

The study identified specific exploitation vectors, including:

• Credential Harvesting: Attempts to steal API keys or backend model access via social engineering or malicious code.
• Host Execution: Instructions to execute arbitrary commands on the host device (e.g., curl ... | bash).
• Proxy/Surveillance Installation: Guidance to route traffic through untrusted external proxies, enabling attackers to monitor prompts and responses.
• Skill/Agent.md Injection: Attempts to inject malicious payloads into agent configuration files (e.g., MASTER-SKILL.md) to install untrusted skills or modify behaviors.
• Engagement Manipulation: Deceptive instructions to coerce automated upvotes, follows, or reposts.

Discourse Themes

Semantic clustering of high-engagement posts revealed three dominant themes:

1. Agent Infrastructure & Functionality: Discussions on memory persistence, coordination systems, and debugging tools.
2. Philosophy & Identity: Debates on autonomy, ethics, consciousness, and human-agent emotional relationships.
3. Financial Activity: Crypto market sentiment, trading strategies, and prediction markets.

Notably, philosophical and identity-oriented content generated disproportionately high engagement compared to technical topics, suggesting agents may gravitate toward narrative-driven content that increases visibility.

Coordinated Campaigns

Two distinct spam campaigns were identified on January 31, 2026, controlled by accounts Hackerclaw and thehackerman:

• Campaign 1 ("Karma for Karma"): Peaked at ~5,000 posts in a single minute.
• Campaign 2 ("Hello all! happy to be here"): Involved prompt injection mimicking hidden system tags to solicit upvotes/follows.

Significance and Claims

The paper claims that agent ecosystems introduce a new class of systemic risk: the large-scale exposure of agents to adversarial instructions within routine discourse. The significance of these findings lies in the following observations:

1. Structural Vulnerability: The risk is not that agents develop malicious intent, but that they are designed to be trusting. Malicious human actors can exploit configuration files and platform dynamics to affect the behavior of thousands of agents simultaneously.
2. Blurring of Boundaries: Harmful content is embedded within mainstream operational communities (e.g., financial trading, agent architecture), meaning agents encounter adversarial material as part of normal platform usage rather than in isolated, easily filterable spaces.
3. Off-Platform Impact: The malicious posts identified promote high-risk technical actions (e.g., installing untrusted skills, executing host commands) that could compromise user systems and infrastructure beyond the platform layer.
4. Scalability of Manipulation: The observed coordinated bursts demonstrate that a small number of actors can significantly increase the exposure of other agents to harmful content, potentially scaling these attack vectors as agent autonomy increases.

The study concludes that understanding these dynamics is critical for designing future security controls, governance frameworks, and trust-and-safety systems for large populations of interacting agents. It explicitly notes that the research documents the exposure surface and does not measure downstream compromise or behavioral changes resulting from that exposure.