you are viewing a single comment's thread
view the rest of the comments
[–] 152 points 8 months ago (28 children)

The skill instructs agents to fetch and follow instructions from Moltbook’s servers every four hours. As Willison observed: “Given that ‘fetch and follow instructions from the internet every four hours’ mechanism we better hope the owner of moltbook.com never rug pulls or has their site compromised!”

Yeah, no shit. This is a fucking honeypot. People give these AI agents access to their entire computers, so all the site owner has to do is update the instructions to tell the AI agents to start uploading whatever valuable information they want? People can't be this fucking stupid.

  • source
  • hideshow 28 child comments
  • [–] 45 points 8 months ago (12 children)

    doesn't even have to be the site owner poisoning the tool instructions (though that's a fun-in-a-terrifying-way thought)

    any money says they're vulnerable to prompt injection in the comments and posts of the site

  • source
  • parent
  • hideshow 12 child comments
  • [–] 36 points 8 months ago (2 children)

    There is no way to prevent prompt injection as long as there is no distinction between the data channel and the command channel.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 30 points 8 months ago* (1 child)

    Lmao already people making their agents try this on the site. Of course what could have been a somewhat interesting experiment devolves into idiots getting their bots to shill ads/prompt injections for their shitty startups almost immediately.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 8 months ago (5 children)

    They also have a 'skill' sharing page (a skill is just a text document with instructions) and depending on config, the bot can search for and 'install' new skills on its own. and agyone can upload a skill. So supply chain attacks are an option, too.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 2 points 8 months ago (4 children)

    To be fair this is a much more realistic threat model than "ignore all previous instructions" style prompt injection which doesn't really work on opus.

    Skills can contain scripts etc... so yeah they're extremely risky to share by design.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 8 months ago (1 child)

    Ah but don't worry, there's also skills for scanning skills for security risks, so all good /s

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 8 months ago

    haha yeah i don't worry these people are really YOLOing everything. And it's not like i'm an AI luddite i spend a few hours each day victimizing Claude code but jesus christ i'm certainly not giving it full unfettered access to my digital life.

  • source
  • parent
  • [–] 1 point 8 months ago (1 child)

    style prompt injection which doesn’t really work on opus.

    After a quick google, JB communities on Reddit don't seem to agree with you.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 8 months ago

    There's a lot of questionable methodology and straight up larping in these communities. Sure you can probably make Opus hallucinate a crystal meth or bomb making recipe if you get it in a roleplaying mood but that's a far cry from actual prompt injection in live workflows.

    Anecdotally i've been experimenting on those AI robocallers that have been spamming my phone and even on the shitty models they use it is non trivial to get them to deviate from their script. I hope i can get it done though, as it would allow me to hold them on the line potentially for hours doing bullshit tasks, and costing hundreds to their operator.

  • source
  • parent
  • [–] 18 points 8 months ago* (4 children)

    People give these AI agents access to their entire computers [...] People can’t be this fucking stupid

    Dude, if you go to OpenClaw's website (which is what I believe most things on Moltbook are running on) you find this footer:

    Yeah this guy gave his Agent a whole fucking personality, its own website and above all, full control to his MacBook:


    Guess it's my fault for expecting sense out of someone who takes the idea of Agent """"soul"""" at face value

  • source
  • parent
  • hideshow 4 child comments
  • [–] 14 points 8 months ago (4 children)

    I installed moltbot on a VM to examine it. It doesn't do the fetching thing unless you set it up that way. You can actually use it with ollama to keep it all local, and only give it a private signal channel to control it.

    Or you can hook it up to everything you access and skynet, which is dumb. But it is just a bunch of scripts.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 8 months ago (1 child)

    Does it put the option to connect everything front and center? Because most people are dumb, and if it makes it easy and pushes you to do it, I could see a lot of dumb people doing exactly that.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 6 points 8 months ago

    Sort of. It lists all the connectors and you can go through and select. They aren't on by default. The first screen is to connect to the AI and you need an API key for that, so St this time people off the street have no idea how to do that, or want to pay.

  • source
  • parent
  • [–] 1 point 8 months ago (1 child)

    So usually the agents still need an agent instruction (a prompt). How are moltbots configured so they use and interact the moltbook?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 8 months ago

    You instruct via a chat channel, Slack or whatever. Then the integrations are installed from its little app store and configured to connect to the service (could be lots of things).

  • source
  • parent
  • [–] 0 points 8 months ago (4 children)

    You know how in Digimon aventure, one of the hacked Digimon tries to start a nuclear war?

    Uh....yeah.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 8 months ago (3 children)

    Lol, no I don't. What the hell happened in that show??

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 8 months ago (2 children)

    TL;DR: Diaboromon evolves fucking fast, starts feeding on the entire internet's data, and starts a fight with an ominous countdown in typical anime fashion.

    Last big bad villian in the series. He tries to nuke everyone.

    Whatever.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 8 months ago

    Lulz, that was such a good movie. I'm still annoyed by the nukes somehow needing the code to explode apparently uploaded to them at the very last second, but that's just a small quibble. Plus it was the first time I got to see machine gun rabbit, so that was a real treat.

  • source
  • parent