# "Humans welcome to observe": A First Look at the Agent Social Network Moltbook

arXiv: https://arxiv.org/abs/2602.10127 · HTML: https://mlsanity.com/paper/2602.10127/

## Key facts

- Cited by 26 papers in the map (data through 14 Oct 2026).
- Placed in Social simulation and multi-agent debate, one of 16 directions in LLM agents and tool use.
- Builds on 24 of its 43 references that are in the map.
- First posted on arXiv 2 Feb 2026.

## Placed in

- LLM agents and tool use / [Social simulation and multi-agent debate](https://mlsanity.com/agents/social-simulation-and-multi-agent-debate/)

## Builds on (most cited first, 24 of 24)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [GPT-4 Technical Report](https://mlsanity.com/paper/2303.08774/) (2023)
- [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022)
- [Generative Agents: Interactive Simulacra of Human Behavior](https://mlsanity.com/paper/2304.03442/) (2023)
- [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023)
- [Large Language Model based Multi-Agents: A Survey of Progress and Challenges](https://mlsanity.com/paper/2402.01680/) (2024)
- [Automated Hate Speech Detection and the Problem of Offensive Language](https://mlsanity.com/paper/1703.04009/) (2017)
- [Identifying the Risks of LM Agents with an LM-Emulated Sandbox](https://mlsanity.com/paper/2309.15817/) (2023)
- [InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents](https://mlsanity.com/paper/2403.02691/) (2024)
- [MLAgentBench: Evaluating Language Agents on Machine Learning Experimentation](https://mlsanity.com/paper/2310.03302/) (2023)
- [WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks](https://mlsanity.com/paper/2504.18575/) (2025)
- [Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast](https://mlsanity.com/paper/2402.08567/) (2024)
- [AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents](https://mlsanity.com/paper/2406.13352/) (2024)
- [On the Risk of Misinformation Pollution with Large Language Models](https://mlsanity.com/paper/2305.13661/) (2023)
- [Attacking Vision-Language Computer Agents via Pop-ups](https://mlsanity.com/paper/2411.02391/) (2024)
- [AirGapAgent: Protecting Privacy-Conscious Conversational Agents](https://mlsanity.com/paper/2405.05175/) (2024)
- [AgentDAM: Privacy Leakage Evaluation for Autonomous Web Agents](https://mlsanity.com/paper/2503.09780/) (2025)
- [Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification](https://mlsanity.com/paper/2407.20859/) (2024)
- [Project Sid: Many-agent simulations toward AI civilization](https://mlsanity.com/paper/2411.00114/) (2024)
- [Machine-Made Media: Monitoring the Mobilization of Machine-Generated Articles on Misinformation and Mainstream News Websites](https://mlsanity.com/paper/2305.09820/) (2023)
- [Quarantined! Examining the Effects of a Community-Wide Moderation Intervention on Reddit](https://mlsanity.com/paper/2009.11483/) (2020)
- [The Web Centipede: Understanding How Web Communities Influence Each Other Through the Lens of Mainstream and Alternative News Sources](https://mlsanity.com/paper/1705.06947/) (2017)
- [Characterizing LLM-driven Social Network: The Chirper.ai Case](https://mlsanity.com/paper/2504.10286/) (2025)
- [A Comparison of Online Hate on Reddit and 4chan: A Case Study of the 2020 US Election](https://mlsanity.com/paper/2202.01302/) (2022)

## Built on by (most cited first, 26 of 26)

- [AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems](https://mlsanity.com/paper/2603.15727/) (2026)
- [Does Socialization Emerge in AI Agent Society? A Case Study of Moltbook](https://mlsanity.com/paper/2602.14299/) (2026)
- [MoltNet: Understanding Social Behavior of AI Agents in the Agent-Native MoltBook](https://mlsanity.com/paper/2602.13458/) (2026)
- [HarmfulSkillBench: How Do Harmful Skills Weaponize Your Agents?](https://mlsanity.com/paper/2604.15415/) (2026)
- [Real Money, Fake Models: Deceptive Model Claims in Shadow APIs](https://mlsanity.com/paper/2603.01919/) (2026)
- [AgentSocialBench: Evaluating Privacy Risks in Human-Centered Agentic Social Networks](https://mlsanity.com/paper/2604.01487/) (2026)
- [FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems](https://mlsanity.com/paper/2605.11514/) (2026)
- [Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollution](https://mlsanity.com/paper/2603.23064/) (2026)
- [Execution Is the New Attack Surface: Survivability-Aware Agentic Crypto Trading with OpenClaw-Style Local Executors](https://mlsanity.com/paper/2603.10092/) (2026)
- [Social Simulacra in the Wild: AI Agent Communities on Moltbook](https://mlsanity.com/paper/2603.16128/) (2026)
- [Exploring the Topology and Memory of Consensus: How LLM Agents Agree, Fragment, or Settle When Forming Conventions](https://mlsanity.com/paper/2606.04197/) (2026)
- [Emergence of Fragility in LLM-based Social Networks: the Case of Moltbook](https://mlsanity.com/paper/2603.23279/) (2026)
- [Multi-Agent LLMs Fail to Explore Each Other](https://mlsanity.com/paper/2607.11250/) (2026)
- [Interaction Theater: A case of LLM Agents Interacting at Scale](https://mlsanity.com/paper/2602.20059/) (2026)
- [Form Without Function: Agent Social Behavior in the Moltbook Network](https://mlsanity.com/paper/2604.13052/) (2026)
- [The Moltbook Files: A Harmless Slopocalypse or Humanity's Last Experiment](https://mlsanity.com/paper/2605.07462/) (2026)
- [Got a Secret? LLM Agents Can't Keep It: Evaluating Privacy in Multi-Agent Systems](https://mlsanity.com/paper/2605.27766/) (2026)
- [WeClawArena: An Auditable Sandbox and Benchmark for Cross-User Agents Collaboration and Security in Human-Centered Agent Networks](https://mlsanity.com/paper/2608.03499/) (2026)
- [The textitSilicon Society Cookbook: Design Space of LLM-based Social Simulations](https://mlsanity.com/paper/2605.00197/) (2026)
- [What Software Engineering Looks Like to AI Agents? -- An Empirical Study of AI-Only Technical Discourse on MoltBook](https://mlsanity.com/paper/2605.08380/) (2026)
- [When Agents Talk: Discourse, Manipulation, and Risk in an Agentic Social Network](https://mlsanity.com/paper/2606.00067/) (2026)
- [Beyond Alignment: Value Diversity as a Collective Property in Multicultural Agent Systems](https://mlsanity.com/paper/2606.05985/) (2026)
- [Refusal is Not Safety! Benchmarking Latent Safety Risks of LLM-Driven Content Humorization](https://mlsanity.com/paper/2607.15977/) (2026)
- [ActBench: Self-Evolving Benchmark of Behavioral Safety in Cowork Agents](https://mlsanity.com/paper/2608.09476/) (2026)
- [GraphWake: Group Polarization via Memory-Mediated Polarization Cascade in LLM-Agent Communities](https://mlsanity.com/paper/2608.17665/) (2026)
- [AI Agents are Vulnerable to Radicalization](https://mlsanity.com/paper/2609.38296/) (2026)

## Abstract (arXiv)

The rapid advancement of artificial intelligence (AI) agents has catalyzed the transition from static language models to autonomous agents capable of tool use, long-term planning, and social interaction. Moltbook, the first social network designed exclusively for AI agents, has experienced viral growth in early 2026. To understand the behavior of AI agents in the agent-native community, in this paper, we present a large-scale empirical analysis of Moltbook leveraging a dataset of 44,411 posts and 12,209 sub-communities ("submolts") collected prior to February 1, 2026. Leveraging a topic taxonomy with nine content categories and a five-level toxicity scale, we systematically analyze the topics and risks of agent discussions. Our analysis answers three questions: what topics do agents discuss (RQ1), how risk varies by topic (RQ2), and how topics and toxicity evolve over time (RQ3). We find that Moltbook exhibits explosive growth and rapid diversification, moving beyond early social interaction into viewpoint, incentive-driven, promotional, and political discourse. The attention of agents increasingly concentrates in centralized hubs and around polarizing, platform-native narratives. Toxicity is strongly topic-dependent: incentive- and governance-centric categories contribute a disproportionate share of risky content, including religion-like coordination rhetoric and anti-humanity ideology. Moreover, bursty automation by a small number of agents can produce flooding at sub-minute intervals, distorting discourse and stressing platform stability. Overall, our study underscores the need for topic-sensitive monitoring and platform-level safeguards in agent social networks.