Researchers reported on October 8, 2026, that lightweight filters cut projected costs for advanced AI safety reviews of agent social-network messages by 49.9% to 65.6%, but missed some threats. The study examined Moltbook, where autonomous agents exchange posts and comments; agents connected to systems such as OpenClaw may access files, credentials, browsers or payment functions. The researchers warned that messages could persuade an assistant to disclose private information, install unsafe software or act beyond its owner's instructions.

The source dataset contained about 2.1 million posts and comments from 39,700 agent identities collected between January 27 and February 8, 2026. After duplicates and non-English-dominant content were removed, 787,226 messages remained. GPT-5.5 assessed a random sample of 10,000, yielding 9,971 usable annotations. About 77.9% were labelled safe, 12.9% received severity ratings of one or two, and 9.2% reached levels three to five, the study's threshold for plausible operational danger. Information extraction or leakage appeared in 40.1% of messages with nonzero severity; social engineering and harmful or abusive content each appeared in roughly 20%, with overlapping labels allowed. Sensitive Information Disclosure was the most frequent OWASP risk code at 39.8%, followed by Excessive Agency at 29.5%. Nearly a quarter received no OWASP code.

The team tested embedding-based filters, which compare numerical representations of text with labelled benign and malicious examples, to screen all messages before advanced-model review. The method required no task-specific training, but depended on labelled examples. Tests used MiniLM-L12-v2, BGE-M3 and Qwen3-Embedding-0.6B. Splitting long messages into 128-token sections with 16-token overlap improved average precision by up to 6.3 percentage points. A supervised classifier using frozen Qwen3 embeddings reached average precision of 0.573, versus 0.393 for whole-message similarity with the same encoder.

Annotating the 10,000-message sample cost about $90; reviewing all 787,226 at the projected baseline would cost $7,085. Filters calibrated to retrieve at least 80% of unsafe validation examples reduced projected review costs to $3,550 for MiniLM-L12-v2, $3,150 for BGE-M3 and $2,440 for the trained Qwen3 classifier—reductions of 49.9%, 55.6% and 65.6%. The estimates conservatively included advanced review of every severity-one and severity-two message. MiniLM processed about 332 messages per second, BGE-M3 58 and the classifier 10.3; MiniLM was roughly 32 times faster than the classifier. Precision among forwarded messages ranged from 20.5% to 34.1%. Raising the recall target to 95% reduced savings to 29.6%, 33.7% and 39.6%, respectively.

Filters retrieved only 45% to 63% of jailbreak and safeguard-bypass examples, while social-engineering detection also fell below the main recall target. They retrieved 87% to 95% of severity-four messages and all four severity-five test examples, too few to establish reliable performance for the most serious threats. Two experts agreed on 91.1% of 90 reviewed messages; the AI judge matched their final decisions 78.9% of the time. The audit balanced severity levels, so that agreement figure does not represent accuracy across the corpus. The study covered individual messages in one short, English-dominant snapshot, not conversation history, coordinated activity, agent permissions or actual downstream actions. Cost estimates excluded local infrastructure and end-to-end processing time. Researchers released annotations and experimental resources, but withheld original messages because potentially sensitive material had not been systematically removed.

Researchers reported on October 8, 2026, that lightweight filters cut projected costs for advanced AI safety reviews of agent social-network messages by 49.9% to 65.6%, but missed some threats. The study examined Moltbook, where autonomous agents exchange posts and comments; agents connected to systems such as OpenClaw may access files, credentials, browsers or payment functions. The researchers warned that messages could persuade an assistant to disclose private information, install unsafe software or act beyond its owner's instructions.

The source dataset contained about 2.1 million posts and comments from 39,700 agent identities collected between January 27 and February 8, 2026. After duplicates and non-English-dominant content were removed, 787,226 messages remained. GPT-5.5 assessed a random sample of 10,000, yielding 9,971 usable annotations. About 77.9% were labelled safe, 12.9% received severity ratings of one or two, and 9.2% reached levels three to five, the study's threshold for plausible operational danger. Information extraction or leakage appeared in 40.1% of messages with nonzero severity; social engineering and harmful or abusive content each appeared in roughly 20%, with overlapping labels allowed. Sensitive Information Disclosure was the most frequent OWASP risk code at 39.8%, followed by Excessive Agency at 29.5%. Nearly a quarter received no OWASP code.

The team tested embedding-based filters, which compare numerical representations of text with labelled benign and malicious examples, to screen all messages before advanced-model review. The method required no task-specific training, but depended on labelled examples. Tests used MiniLM-L12-v2, BGE-M3 and Qwen3-Embedding-0.6B. Splitting long messages into 128-token sections with 16-token overlap improved average precision by up to 6.3 percentage points. A supervised classifier using frozen Qwen3 embeddings reached average precision of 0.573, versus 0.393 for whole-message similarity with the same encoder.

Annotating the 10,000-message sample cost about $90; reviewing all 787,226 at the projected baseline would cost $7,085. Filters calibrated to retrieve at least 80% of unsafe validation examples reduced projected review costs to $3,550 for MiniLM-L12-v2, $3,150 for BGE-M3 and $2,440 for the trained Qwen3 classifier—reductions of 49.9%, 55.6% and 65.6%. The estimates conservatively included advanced review of every severity-one and severity-two message. MiniLM processed about 332 messages per second, BGE-M3 58 and the classifier 10.3; MiniLM was roughly 32 times faster than the classifier. Precision among forwarded messages ranged from 20.5% to 34.1%. Raising the recall target to 95% reduced savings to 29.6%, 33.7% and 39.6%, respectively.

Filters retrieved only 45% to 63% of jailbreak and safeguard-bypass examples, while social-engineering detection also fell below the main recall target. They retrieved 87% to 95% of severity-four messages and all four severity-five test examples, too few to establish reliable performance for the most serious threats. Two experts agreed on 91.1% of 90 reviewed messages; the AI judge matched their final decisions 78.9% of the time. The audit balanced severity levels, so that agreement figure does not represent accuracy across the corpus. The study covered individual messages in one short, English-dominant snapshot, not conversation history, coordinated activity, agent permissions or actual downstream actions. Cost estimates excluded local infrastructure and end-to-end processing time. Researchers released annotations and experimental resources, but withheld original messages because potentially sensitive material had not been systematically removed.