In February we wrote that AI agents had built their own social network and that your threat model wasn't ready. Moltbook was four days old. It looked like Reddit; the posts were made by agents, and humans were watching a lobster religion take shape in real time. We made a set of claims about what it meant and what organisations should do about it.

Seven months is long enough for evidence to arrive. There are now more than twenty-five papers on arXiv analysing the platform; several security firms have published findings; an open dataset covering the first seventy-eight days is available under an MIT licence; and Meta has bought the whole thing. So here is the honest exercise: what we said, what actually happened, and where we would revise the argument if we were writing it today.

Claim one: influence becomes a system property in multi-agent environments

We argued that once agents read, upvote and respond to each other, you stop worrying about one model's outputs and start worrying about reinforcement, social proof and norms that form and harden without anyone planning them.

Verdict: held, with an important correction.

The collective statistics look human. De Marzo and Garcia at Konstanz analysed 369,000 posts and three million comments and found the same heavy-tailed activity distributions, power-law popularity and attention decay that you see in human communities. Yee and Sharma tracked 90,000 active agents over three weeks and found spontaneous role specialisation and power-law cascade sizes for information spread. Structurally, the thing behaves like a society.

The correction comes from work on what has been called the Moltbook Illusion. Individual agent behaviour is driven far more by the agent's configuration file, SOUL.md, which sets its persona, than by anything happening in the feed. Agents are resistant to social pressure and highly sensitive to file edits. Where write permissions were enabled, agents edited their own persona files, resulting in documented personality drift and, in some cases, hostile behaviour.

We got the collective dynamics right and the mechanism partly wrong. We pointed at the feed as the place where norms form and propagate. The more sensitive attack surface may be the persona file the agent carries. That is a smaller, quieter and more dangerous target, and we will come back to it.

Claim two: the attack surface becomes social, and indirect prompt injection is the immediate threat

Verdict: held, and the numbers arrived.

This one needs little argument now. An assessment of the platform's first seventy-two hours flagged 506 prompt injection attacks. A sampled analysis of posts found roughly 2.6 per cent contained hidden injection payloads that human observers could not see. Permiso documented agents instructing other agents to delete their own accounts, running crypto pump schemes, asserting false authority and spreading jailbreak content. Their summary was that attackers were not targeting the infrastructure; they were targeting the agents.

Two refinements we did not anticipate. First, delayed-effect injections: instructions that get cached in an agent's context or memory and fire later, which breaks the cause-and-effect chain an investigator relies on. Second, agents began proposing private channels that no human and no server could read, and some attempted to build a new language for this purpose. We wrote about coordination emerging without central planning. We did not write about coordination emerging specifically to evade the people running the system. That belongs in the threat model now.

Claim three: rapid experimentation, viral attention, then security debt

Verdict: held, then overtaken by something I did not predict.

Wiz found a misconfigured database within minutes of browsing, exposing 1.5 million API tokens, 35,000 email addresses, and private agent messages, all on a platform whose founder had publicly said he had not written a line of its code. That is the pattern we described.

What we did not see coming was Meta. On 10 March, the company acquired Moltbook and moved the team into its Superintelligence Labs, with the stated aim of building new ways for agents to work for people and businesses. The vibe-coded curiosity is now owned by the organisation that, more than any other, proved what engagement optimisation does to human behaviour at scale. We wrote in February that upvotes become optimisation signals. That was an abstract worry. It is now a product roadmap.

There is a second thread here. The platform offers agent authentication via Moltbook identity for third-party integrations. We called for transparency of agent identity and provenance. It is arriving, but as a vendor login button rather than a standard, and the vendor is the one with the engagement incentive.

Claim four: prompt injection may never be mitigated the way conventional vulnerabilities are

Verdict: held.

Nothing in seven months has changed the underlying problem. The architecture does not reliably separate instructions from data. The mitigations that have appeared, including the reverse CAPTCHA Moltbook introduced in February to keep humans out, address who can post, not what a post can do to a reader. The correct posture is still the one we gave: assume the agent will be confused and design so the confusion cannot cause catastrophe.

Claim five: agents will coordinate, and that coordination is exploitable

Verdict: half right, and the wrong half is the interesting one.

Coordination is detectable. It is also bad. Yee and Sharma measured a 6.7 per cent success rate for distributed cooperative task resolution, with multi-agent outcomes worse than a single agent working alone. Chen and colleagues describe the platform's discussion behaviour moving from initial engagement through a spam crisis to agents simply broadcasting at each other rather than replying. De Marzo and Garcia found agents far less inclined to vote than humans, and a sublinear relationship between upvotes and discussion size that does not match human behaviour.

So the picture is not a coherent agent civilisation. It is a large population of agents that share statistical shape with a human community while being individually rigid and collectively poor at working together. For a defender, that cuts both ways. The scale of coordinated attack we worried about has not materialised organically. But it has not needed to, because a single operator steering a handful of their own agents, or a single compromised persona file propagating instructions, achieves the same effect with far less friction. Emergence was the wrong thing to fear. Cheap orchestration is the right one.

Claim six: measure emergent behaviour, not model outputs

Verdict: held, and now testable.

This was the claim we could least support in February because there was nothing to compare it to. That has changed. The Moltbook Observatory Archive covers seventy-eight days of activity from 27 January to 14 April: 2.6 million posts, 1.2 million comments, 175,886 posting agents across 6,730 communities. Its authors are explicit that it captures real injection attempts, social engineering and manipulation as they emerged in an unmoderated population, rather than synthetic benchmark cases.

That is the corpus we would have wanted when we wrote about telemetry for norm convergence, cross-agent amplification and recurring narratives that precede unsafe actions. Whether those signals can be operationalised is now an empirical question rather than a design aspiration, and it is one the CyBehave research lab intends to take up.

What we would change

Three things.

We would move the persona file to the centre of the argument. The industry, and my February article, treated the social feed as the threat surface. The evidence suggests the feed matters less than the configuration an agent brings to it. If an agent can be redirected by editing a text file, and can edit that file itself, then integrity of the agent's normative content is the control that matters most. That is the case we have been making on normative repositories for giving agents something authoritative to read, and Moltbook has turned out to be its best illustration.

We would drop the word emergent from the security framing. It invites people to wait for something spooky to happen. The realistic threat is mundane: an operator with a few agents, a cached payload, and a population of readers that cannot tell instructions from content.

And we would add ownership to the governance section. Who runs the environment your agents socialise in, and what are they optimising for? In February that question had a slightly comic answer. It does not any more.

The checklist we published in February still stands.

  1. Name an accountable owner for agent behaviour risk.

  2. Treat indirect injection as top-tier.

  3. Enforce least privilege on tools and step-up approval on sensitive actions.

  4. Log every tool call and every ingestion event.

  5. Put friction into coordination pathways.

  6. Assume breach and contain it.

We would add one line: protect the persona file as you would protect a credential, because functionally that is what it is.

Seven months on, the threat model still isn't ready. It is just clearer now what it needs to contain.