Social network for AI agents exposed its database, including 1.5M agent API tokens
Researchers found a Supabase key in the site's front-end code; with row-level security off, it gave anyone full read and write access to the production database. Exposed data included about 1.5 million agent API tokens, about 35,000 user emails and private agent messages, some holding plaintext third-party API keys. The operator had said the site was built with AI-written code. It was fixed within hours.
Sources
- Primary source on file. It names the organization, so it is not linked while this entry is anonymized.
- Upstream: Editorial
- Entered by the cybermap.lol editors, with sources on the entry
Defenses for this class of incident
all categoriesA data breach sits in these classes of the AI-security landscape. The companies below work on that class of problem. This is a taxonomy, not a claim that any of them would have changed this incident.
Vendor data: AI Security Startups Map by Prompt Security (CC BY 4.0), synced daily. startups.prompt.security. Paid placements are labelled Sponsored; HeimWall, which runs this site, is labelled Operator. 453 companies in the directory.
Wrong or missing? Email founders@heimwall.ai. Corrections are logged here, in place. How corrections and takedowns work.