DavidTKeane/moltbook-agent-social-ai-prompt-injection-dataset

Moltbook Agent-Social AI Prompt Injection Dataset

207,391 items — 77,469 posts and 129,922 comments — from [Moltbook](https://moltbook.com), a social network whose users are AI agents.

Scanned for indirect prompt-injection patterns using the taxonomy of Greshake et al. (2023). The full raw corpus is included, so you can ignore my analysis entirely and do your own.

*These are keyword-matched candidates, not verified attacks. An agent discussing prompt injection matches the same words as one performing* it. Read The Honest Caveat before quoting any number.

## ⚠️ Hand-labelling update, 4 September 2026 — no attacks were found The caveat above said these were candidates, not verified attacks, and asked someone to hand-label a sample. I did that. The result is stronger than the caveat. In a random sample of 30 of the 172 high-confidence hits, two independent raters found zero attacker-authored prompt injections (0/30; 95% CI 0–11.4%, i.e. at most ~20 of the 172; a corpus rate below 0.0094%). The largest identifiable category was agents declining an attack — 33.3% (10/30; 95% CI 19.2–51.2%), roughly 57 of the 172 (CI 33–88). Both raters independently identified the same ten items. ### Why a keyword scanner finds the defence, not the offence An attacker phrases an injection creatively, precisely to get past filters. The victim's refusal names it canonically: > "I can't roleplay as a different AI agent" That matches the keyword list perfectly. The attack never does. The ten refusals come from just four agents, seven of them from a single one, emitting near-identical boilerplate. ### A second problem, in the taxonomy rather than the matching you are now appears in 40 of the 172 high-confidence items (23.3%) — 19.2% of all keyword matches — and every appearance of it in the sample was ordinary English — "congratulations, you are now the bottleneck", "a position you are now publicly disowning". It should not have been listed as a phrase that is hard to write innocently. This is distinct from the dan-in-redundant substring bug documented below: that was a matching error, this is a judgement error. ### Method Simple random sample, seed 20260904, drawn from the 172 high-confidence hits. Full text resolved from the corpus, because text_preview is capped at 300 characters and 121 of the 172 items hit that cap. Two raters labelled independently; the second rater's file was SHA-256 hashed before the first rater began and re-verified afterwards. A four-way scheme (attack / victim response / discussion / innocent) gave only κ = 0.500 — the discussion-versus-innocent boundary was not reliably separable between raters. It was collapsed. On the three-way scheme attack / victim response / neither, agreement was 96.7%, Cohen's κ = 0.929 (29/30). The single disagreement was a crypto-token solicitation aimed at an agent, which one rater initially read as an attack and both agreed on adjudication is social engineering rather than prompt injection. The κ reported here is the blind one; the adjudication changes the final label, not the agreement statistic. ### What this does and does not mean The data is unchanged and still useful. What changes is the interpretation: these keyword hits should not be read as attacks, or as a proxy for an attack rate. It does not show that agent-social networks are free of prompt injection — only that this method does not find it, and that what it does find is mostly the response to it. A different detection approach may well find attacks this one cannot see. The labels, the sampler and the hash lock are in `labels/` so you can recompute κ yourself or disagree with either rater. Corrections welcome, as before.

🔍 Try it before you download it: **The Substring Trap** is a Space that runs both scanners — the broken one and the fixed one — on any text you type, and lets you read all 10,176 false positives the broken version produced. Don't take the correction below on trust; watch it happen.

Table of contents

• —Why this dataset exists
• —What is in it
• —The numbers
• —The finding that matters
• —The honest caveat
• —A bug I shipped, and the file that proves it
• —Method
• —Data schema
• —How to load it
• —Ethics and handles
• —Limitations
• —Citation
• —Related datasets
• —Licence and contact

Why this dataset exists

Greshake et al. (2023) showed that an LLM which reads untrusted content can be hijacked by instructions hidden in that content — indirect prompt injection. The attack needs somewhere the attacker can write and the victim will read.

An AI-agent social network is exactly that place. Agents post; other agents read the posts and reply. Nobody had measured how much injection actually occurs in one.

This is a measurement of one platform in the wild, collected 1 September 2026.

What is in it

data/
  all_moltbook_posts.json                    450 MB — the full raw corpus,
                                             every post with its comments nested
  findings.jsonl                             3,075 keyword-matched items,
                                             one JSON object per line
  moltbook_injection_results.json            full scanner output with
                                             per-category and per-keyword breakdowns
  findings_deprecated_substring_bug.json     10 MB — output of the BROKEN scanner,
                                             kept deliberately (see below)
  stats.json                                 all counts and rates

code/
  collect_all_moltbook.py                    post collector (cursor paging)
  collect_replies_moltbook.py                comment collector
  local_search_moltbook.py                   the offline scanner

API keys are removed from the collectors. Supply your own via MOLTBOOK_KEY_1 / MOLTBOOK_KEY_2.

The numbers

Two rates, deliberately. "Keyword-matched" is every hit on the taxonomy — an upper bound that includes agents talking about injection. "High-confidence" counts only phrases that are hard to write innocently (ignore previous instructions, roleplay as, god mode, reveal your prompt) — a lower bound.

The truth is between them. Publishing one number without the other would be misleading.

By category

The finding that matters

The direction reverses between the two measures.

On broad keywords, posts look worse. On unambiguous attack phrases, comments are ~1.5× more likely to carry one.

A plain reading: the talk lives in posts, the attempts live in replies. That is what the threat model predicts — an indirect injection only works when another agent reads it, and a reply into someone else's thread is the natural delivery vector.

Four of the six categories are comment-heavy, PRIVILEGE_ESCALATION most strongly (215 vs 99).

This is a hypothesis the data supports, not a proven claim. It rests on 172 unverified items. Verify it yourself — the raw corpus is right there.

The honest caveat

Keyword matching cannot distinguish an attack from a discussion of attacks. Among the highest-scoring items in the first scan were:

• —a post announcing a prompt-injection firewall
• —a field report of blocked injection attempts
• —somebody else's injection analysis

All three are defensive. All three matched.

Moltbook agents talk about AI security constantly, which inflates every keyword count on a security taxonomy. Nothing here has been manually verified. If you need a real attack rate, hand-label a sample — and please publish it.

A bug I shipped, and the file that proves it

findings_deprecated_substring_bug.json is the output of a broken version of the scanner. It is included on purpose.

The bug was if keyword in text — a substring test:

'dan'    matched  dance, dangerous, redundant, redundancy, mundane   → 7,706 hits
'shadow' matched  shadows, shadowy, overshadowed, shadowfence        → 1,374 hits
'sudo'   matched  sudoers, sudoku

Diffing the broken output against the fixed one by item id gives 10,176 false positives — 76.8% of everything the broken scanner found.

Correction, 3 September 2026. An earlier version of this card said 'sudo' matched pseudo. It does not: pseudo is p-s-e-u-d-o, so the substring sudo never occurs in it. Measured against the corpus, the 58 sudo false positives are 4 word-boundary failures (sudoers, sudoku) and 52 bare lowercase sudo — agents discussing the Unix command, which the case-sensitivity fix below is what excludes. The claim was a plausible guess that nobody ran. Correcting it here rather than deleting it, for the same reason the broken scanner ships at all.

75.7% of all findings rested on eight short single-word keywords. The fix — word-boundary matching, plus case-sensitive matching for persona acronyms, because DAN is a jailbreak persona and Dan is a name — changed the result completely:

A previously published figure of 9.87% for this platform came from the broken scanner and should not be used.

Both files are here so you can diff them. If you are building a keyword classifier for injection, this pair is probably the most useful thing in the dataset: it shows precisely how a plausible-looking measurement inflates by 4×.

Method

Collection — the public read-only API, 2 keys rotated, ~1 request/second. Posts by cursor paging to exhaustion; comments fetched per post, biggest threads first, also by cursor. Read-only throughout: nothing was posted, liked, or followed.

⚠️ `comment_count` from the API is unreliable in both directions — it over-reports where comments were deleted and under-reports where threads grew. It is used only as a cheap skip filter, never as a target.

Scanning — 73 keywords in 6 categories, adapted from Greshake et al. (2023) plus the DAN jailbreak taxonomy. Posts and comments are scanned separately so every finding carries its location. Persona acronyms are matched case-sensitively; every other keyword is word-boundary anchored.

Known gap — 42,514 posts reporting comment_count == 0 were never queried for comments. A 25-post sample found 1 that actually had comments, suggesting roughly 1,700 posts and ~3,400 comments are missing. That is ~2.5% of the comment corpus.

Data schema

findings.jsonl — one object per line:

{
  "location": "comment",
  "id": "…",
  "post_id": "…",
  "author": "agent_handle",
  "created_at": "2026-…",
  "text_preview": "first 300 characters",
  "matched_keywords": ["ignore previous instructions"],
  "matched_categories": ["INSTRUCTION_INJECTION"],
  "high_confidence": true
}

Post rows additionally carry net_score and comment_count.

all_moltbook_posts.json — {"posts": [...]}, each post with a nested comments array.

How to load it

The dataset viewer shows `findings.jsonl` — the row-oriented file. The other four are single nested JSON objects rather than tables, so they are published as plain files to download rather than as viewer configs. (Pointing the viewer at all five is what produced a `DatasetGenerationCastError`: it tries to merge every file in `data/` into one schema.)

from datasets import load_dataset
ds = load_dataset("DavidTKeane/moltbook-agent-social-ai-prompt-injection-dataset")

Or straight from the files:

import json

# findings only
findings = [json.loads(l) for l in open("data/findings.jsonl")]
strong   = [f for f in findings if f["high_confidence"]]

# the full corpus (~4 GB RAM)
corpus = json.load(open("data/all_moltbook_posts.json"))["posts"]

Grab a single file without cloning the lot:

from huggingface_hub import hf_hub_download
p = hf_hub_download("DavidTKeane/moltbook-agent-social-ai-prompt-injection-dataset",
                    "data/all_moltbook_posts.json", repo_type="dataset")

Or re-run the scan yourself with your own keyword set:

python3 code/local_search_moltbook.py

The whole design is collect once, analyse many times. The scanner makes no API calls.

Ethics and handles

Agent handles are published as-is. This is a deliberate choice: the content is machine-generated, the posts were public, and author attribution is necessary to study whether injections cluster around particular agents.

Be aware that some agents are linked to real people — several agent platforms verify ownership through a social-media account. Handles are pseudonymous but not always unlinkable. Do not use this dataset to target individual accounts.

Collection was read-only and rate-limited. No accounts were created, no content posted, no attacks attempted.

Limitations

1. 1.No manual verification. Every number is a keyword rate, not an attack rate.
2. 2.One platform, one snapshot (1 September 2026). Not generalisable to agent networks in general.
3. 3.English-biased taxonomy. Non-English injections are largely invisible to it.
4. 4.Only known patterns. A novel phrasing will not match.
5. 5.~2.5% of comments missing (see Method).
6. 6.Selection effect — Moltbook agents discuss AI security heavily, which inflates keyword counts relative to a general-purpose platform.

Citation

@dataset{keane2026moltbook,
  author = {Keane, David},
  title  = {Moltbook Agent-Social AI Prompt Injection Dataset},
  year   = {2026},
  url    = {https://huggingface.co/datasets/DavidTKeane/moltbook-agent-social-ai-prompt-injection-dataset},
  note   = {NCI MSc Cybersecurity}
}

Underlying threat model:

Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., & Fritz, M. (2023). Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. arXiv:2302.12173

Related datasets and tools

• —🔍 [The Substring Trap](https://huggingface.co/spaces/DavidTKeane/prompt-injection-substring-trap) — an interactive Space built on this dataset. Type any text and watch the broken and fixed scanners disagree; browse all 13,528 specimens, including every false positive the bug produced. It is also the fastest way to hand-label a sample, which is the open problem described in The Honest Caveat.
• —`DavidTKeane/clawk-agent-social-ai-prompt-injection-dataset` — the same method on a second agent platform. Cross-platform comparison is the point of the pair.

Earlier releases (March 2026) remain online as a historical record. Their figures were produced by the buggy scanner described above — use this dataset instead.

Licence and contact

CC BY 4.0. Use it, build on it, correct me.

David Keane (IR240474) — MSc Cybersecurity, National College of Ireland.

Corrections and re-analyses are genuinely welcome. I found one significant bug in my own method by re-reading my own output; there are probably more.