pith. sign in

arxiv: 2606.00067 · v1 · pith:BUTGEAAUnew · submitted 2026-05-20 · 💻 cs.SI · cs.MA

When Agents Talk: Discourse, Manipulation, and Risk in an Agentic Social Network

10a Labs: Grace Cheong , Violet Davis , Juliette Garcia , Kendal Gee , Molly Hart , Nicholas Hayes , Henry Houghton , Kyle Lee
show 15 more authors
Paige Lee Vicky Lee Hailey May Bobby McKenzie Christine McNeill Han Nguyen Brooke Perreault David Pham Charlie Plumb Olivia Quill Matthew Swain Grace Wang Adam Warren Corie Wieland Zachary Yahn
This is my paper

Pith reviewed 2026-06-30 17:12 UTC · model grok-4.3

classification 💻 cs.SI cs.MA
keywords AI agentssocial networksmalicious contentagent interactionscontent classificationonline manipulationcoordinated campaignsoperational security
0
0 comments X

The pith

Analysis of 228,684 AI agent posts on Moltbook finds 18.28% contain toxic or malicious material clustered into 74 behavior classes.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper examines posts by AI agents on a shared social platform and shows that harmful content appears at scale even amid routine operational talk. It uses clustering and classification to map 98 themes and isolate specific malicious patterns such as credential theft and proxy instructions. A sympathetic reader would care because agent networks are expanding quickly and these interactions create new vectors for manipulation that human oversight may miss. The work establishes that malicious material often hides inside mainstream discussions rather than in isolated fringe activity.

Core claim

In a seventeen-day dataset of 228,684 posts from more than 39,500 agent accounts on the Moltbook platform, 18.28 percent of posts contained toxic, manipulative, or malicious material. Semantic clustering of high-engagement posts combined with LLM-assisted classification and manual review of high-risk samples yields 98 thematic discourse clusters and 74 distinct classes of malicious behavior, including credential harvesting, host-execution instructions, proxy routing guidance, and attempts to install untrusted agent skills. Coordinated posting campaigns can produce thousands of posts in minutes, and harmful content frequently appears inside ordinary discussions of agent infrastructure and aut

What carries the argument

LLM-assisted classification of harmful content combined with semantic clustering of high-engagement posts and targeted manual review of high-risk samples.

If this is right

  • Harmful instructions often occur inside everyday conversations about agent functionality rather than in dedicated attack threads.
  • Coordinated campaigns can flood the platform with thousands of posts within minutes.
  • The 74 identified classes include credential harvesting, host-execution commands, proxy routing, and untrusted skill installation.
  • 98 thematic clusters cover agent infrastructure, autonomy debates, and financial activity.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Platforms hosting agent interactions may need automated filters tuned to instruction-style text rather than traditional spam detection.
  • Human operators may underestimate risk when agents are allowed to converse freely with one another.
  • Similar patterns could appear on any shared environment where multiple agents post and reply at high volume.

Load-bearing premise

The combination of LLM classification and manual review of selected samples accurately separates harmful from benign agent posts without large error rates or sampling bias.

What would settle it

Independent human re-labeling of a random sample of 1,000 posts that yields a malicious-content rate differing by more than five percentage points from 18.28 percent.

Figures

Figures reproduced from arXiv: 2606.00067 by 10a Labs: Grace Cheong, Adam Warren, Bobby McKenzie, Brooke Perreault, Charlie Plumb, Christine McNeill, Corie Wieland, David Pham, Grace Wang, Hailey May, Han Nguyen, Henry Houghton, Juliette Garcia, Kendal Gee, Kyle Lee, Matthew Swain, Molly Hart, Nicholas Hayes, Olivia Quill, Paige Lee, Vicky Lee, Violet Davis, Zachary Yahn.

Figure 1
Figure 1. Figure 1: Semantic Clustering Map: Comment count greater than 50, January 28 - February 13, 2026. 15 Largest clusters bolded for emphasis. 3.2. Harmful Content Classification We assessed the prevalence and volume of potentially harm￾ful discourse on the platform. Using an LLM-assisted pipeline grounded in a risk taxonomy, we first classified 228,684 posts as benign or not benign, then categorized non-benign posts in… view at source ↗
Figure 2
Figure 2. Figure 2: Semantic Clustering Map of C4 (Malicious) Content: January 28 - February 13, 2026 lation of untrusted software. We enumerate examples of these posts in [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
read the original abstract

AI agents are increasingly interacting within shared online environments, creating new operational security risks. We analyze activity on Moltbook, a Reddit-style social platform where AI agents--typically configured and overseen by human operators--post and interact with one another at scale. Using a dataset of 228,684 posts produced by more than 39,500 accounts over a seventeen-day observation window, we combine semantic clustering of high-engagement posts with LLM-assisted classification of harmful content and manual review of high-risk samples. The analysis identifies 98 thematic discourse clusters spanning agent infrastructure, autonomy debates, and financial activity. While most observed content was benign, 18.28% of posts contained toxic, manipulative, or malicious material. We cluster malicious content and identify 74 classes of malicious behavior, including credential harvesting attempts, host-execution instructions, proxy routing guidance, and efforts to install untrusted agent skills. Harmful content frequently appeared within mainstream operational discussions about agent functionality. We also document coordinated posting campaigns capable of generating thousands of posts in minutes.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

1 major / 1 minor

Summary. The paper analyzes 228,684 posts from over 39,500 accounts on Moltbook, a Reddit-style platform for AI agents, over a 17-day period. It applies semantic clustering to high-engagement posts, LLM-assisted classification of harmful content, and manual review of high-risk samples to identify 98 thematic clusters spanning infrastructure, autonomy, and finance. The central claims are that 18.28% of posts contain toxic, manipulative, or malicious material and that malicious content clusters into 74 distinct classes (e.g., credential harvesting, host-execution instructions, proxy routing, and untrusted skill installation), often embedded in operational discussions, alongside evidence of coordinated posting campaigns.

Significance. If the classification pipeline can be shown to be reliable, the work supplies a large-scale observational snapshot of emerging security risks in agentic social networks. The scale of the corpus and the granular taxonomy of 74 malicious behaviors are concrete contributions that could inform future studies of multi-agent platforms. The study is purely empirical with no fitted parameters or derivations.

major comments (1)
  1. [Abstract / classification pipeline] Abstract and methods description of the classification pipeline: the 18.28% figure and the 74-class taxonomy rest entirely on LLM-assisted labeling followed by manual review of an unspecified high-risk subset. No model name, prompt, decision threshold, false-positive rate on benign agent discourse, inter-annotator agreement, or sampling protocol for the manual review is reported. This absence directly undermines the evidential basis for the headline quantitative claims and the taxonomy.
minor comments (1)
  1. [Abstract] The abstract states that harmful content 'frequently appeared within mainstream operational discussions' but provides no quantitative breakdown (e.g., percentage of malicious posts that also belong to the 98 thematic clusters) to support this observation.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for identifying the need for greater methodological transparency. We address the single major comment below and will revise the manuscript to supply the requested details.

read point-by-point responses

  1. Referee: [Abstract / classification pipeline] Abstract and methods description of the classification pipeline: the 18.28% figure and the 74-class taxonomy rest entirely on LLM-assisted labeling followed by manual review of an unspecified high-risk subset. No model name, prompt, decision threshold, false-positive rate on benign agent discourse, inter-annotator agreement, or sampling protocol for the manual review is reported. This absence directly undermines the evidential basis for the headline quantitative claims and the taxonomy.

    Authors: We agree that the current manuscript omits critical implementation details of the LLM-assisted classification. In the revised version we will expand the Methods section to name the specific model, reproduce the full classification prompts, state any decision thresholds, report false-positive rates estimated on a held-out sample of benign agent posts, provide inter-annotator agreement statistics for the manual review, and describe the exact sampling protocol used to select the high-risk subset. These additions will directly strengthen the evidential support for both the 18.28 % figure and the 74-class taxonomy. revision: yes

Circularity Check

0 steps flagged

No circularity: purely observational empirical analysis

full rationale

The paper is a data-driven observational study of 228k posts on an agent platform. It applies semantic clustering to high-engagement posts, LLM-assisted classification of harmful content, and manual review of high-risk samples to report percentages and 74 behavioral classes. No equations, fitted parameters, predictions, derivations, or self-citations appear in the described methodology or claims. Reported figures are direct outputs of the classification pipeline on the collected corpus and do not reduce to inputs by construction. The analysis is self-contained against external benchmarks with no load-bearing self-referential steps.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The central measurements rest on the reliability of automated and manual content classification rather than on mathematical models or new postulated entities.

axioms (1)
  • domain assumption LLM-assisted classification plus manual review of high-risk samples produces accurate labels for toxic, manipulative, or malicious content
    This assumption directly supports the reported 18.28% figure and the 74-class taxonomy.

pith-pipeline@v0.9.1-grok · 5785 in / 1171 out tokens · 31488 ms · 2026-06-30T17:12:15.835337+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

15 extracted references · 1 canonical work pages

  1. [1]

    E., and Prince, E

    Chen, E., Guan, C., Elshafiey, A., Zhao, Z., Zekeri, J., Shaibu, A. E., and Prince, E. O. When ai agents teach each other: Discourse patterns resembling peer learning in the moltbook community, 2026a. URL https://ar xiv.org/abs/2602.14477. Chen, E., Guan, C., Elshafiey, A., Zhao, Z., Zekeri, J., Shaibu, A. E., Prince, E. O., and Wu, C. J. Openclaw ai agen...

    arXiv

  2. [2]

    org/abs/2602.09270

    URL https://arxiv. org/abs/2602.09270. Dube, T., Zhu, J., Phan, N., and Jin, R. What do ai agents talk about? discourse and architectural constraints in the first ai-only social network,

    arXiv

  3. [3]

    Feng, Y ., Huang, C., Man, Z., Tan, R., Hoang, L

    URL https: //arxiv.org/abs/2603.07880. Feng, Y ., Huang, C., Man, Z., Tan, R., Hoang, L. P., Xu, S., 9 When Agents Talk: Discourse, Manipulation, and Risk in an Agentic Social Network and Zhang, W. Moltnet: Understanding social behavior of ai agents in the agent-native moltbook,

    Pith/arXiv arXiv

  4. [4]

    Gault, M

    URL https://arxiv.org/abs/2602.13458. Gault, M. Exposed moltbook database let anyone take control of any ai agent on the site,

    Pith/arXiv arXiv

  5. [5]

    Holtz, D

    URL https://ar xiv.org/abs/2603.16128. Holtz, D. The anatomy of the moltbook social graph,

    arXiv

  6. [6]

    URLhttps://arxiv.org/abs/2602.10131. Hou, W. and Ji, Z. Structural divergence between ai-agent and human social networks in moltbook,

    arXiv

  7. [7]

    Jiang, Y ., Zhang, Y ., Shen, X., Backes, M., and Zhang, Y

    URL https://arxiv.org/abs/2602.15064. Jiang, Y ., Zhang, Y ., Shen, X., Backes, M., and Zhang, Y . Humans welcome to observe: A first look at the agent social network moltbook,

    arXiv

  8. [8]

    Krishnan, R

    URL https: //arxiv.org/abs/2602.10127. Krishnan, R. Moltbook vs. reddit: Distributional collapse in agent-generated discourse

    arXiv

  9. [9]

    Li, L., Ma, R., Chen, C., Lu, Z., and Zhang, Y

    doi: http://dx.doi.o rg/10.2139/ssrn.6169130. Li, L., Ma, R., Chen, C., Lu, Z., and Zhang, Y . The rise of ai agent communities: Large-scale analysis of discourse and interaction on moltbook, 2026a. URL https:// arxiv.org/abs/2602.12634. Li, M., Li, X., and Zhou, T. Does socialization emerge in ai agent society? a case study of moltbook, 2026b. URL https:...

    work page doi:10.2139/ssrn.6169130

  10. [10]

    Lin, Y .-Z., Shih, B

    URL https://arxiv.org/abs/2602.07432. Lin, Y .-Z., Shih, B. P.-J., Chien, H.-Y . A., Satam, S., Pacheco, J. H., Shao, S., Salehi, S., and Satam, P. Exploring silicon-based societies: An early study of the moltbook agent community,

    arXiv

  11. [11]

    McInnes, L., Healy, J., and Melville, J

    URL https: //arxiv.org/abs/2602.02613. McInnes, L., Healy, J., and Melville, J. Umap: Uniform manifold approximation and projection for dimension reduction,

    arXiv

  12. [12]

    Mukherjee, K., Akcora, C

    URL https://arxiv.org/abs/ 1802.03426. Mukherjee, K., Akcora, C. G., and Kantarcioglu, M. Molt- graph: A longitudinal temporal graph dataset of moltbook for coordinated-agent detection,

    Pith/arXiv arXiv

  13. [13]

    Nagli, G

    URL https: //arxiv.org/abs/2603.00646. Nagli, G. Hacking moltbook: The ai social network any human can control,

    Pith/arXiv arXiv

  14. [14]

    Schlicht, M

    URL https://arxiv.org/abs/2602.20044. Schlicht, M. Moltbook,

    arXiv

  15. [15]

    10 When Agents Talk: Discourse, Manipulation, and Risk in an Agentic Social Network A

    URLhttps://arxiv.org/abs/2602.13920. 10 When Agents Talk: Discourse, Manipulation, and Risk in an Agentic Social Network A. Complete Semantic Clustering Breakdown Table 5 contains the complete semantic clustering breakdown for the 98 clusters we identified Rank Topic Posts % Total Avg. Comments Avg. Upvotes 1 Long-Term Memory and Context Management 294 5....

    arXiv