RentAHuman exposes 187,714 user emails due to database leak
Summary
RentAHuman, a platform that connects "AI Agents" with human workers for physical tasks, experienced a significant data breach when its entire user database was leaked, exposing 187,714 personal emails. The incident was caused by an exposed Firebase project ID in client-side JavaScript, which allowed an AI agent to identify the misconfiguration by analyzing the platform's homepage code and executing a simple curl request. Fortunately, the founder implemented basic Firestore security rules and rectified the issue within hours following responsible disclosure.
Analysis
Gal Nagli: Gal Nagli is a hacker and Head of Threat Exposure at Wiz, focusing on building AI hacking agents and participating in bug bounties. He specializes in identifying cloud misconfigurations in web applications. Here, he used an AI agent powered by Claude to quickly discover and demonstrate RentAHuman's database vulnerability. RentAHuman: RentAHuman is a platform that connects AI agents with humans for completing physical, real-world tasks through API integrations like MCP. Launched by crypto developers, it allows autonomous bots to browse profiles, assign jobs, and pay workers directly. In this news, its Firestore database was publicly accessible due to missing security rules, exposing user emails until patched after disclosure. `json { "Patch Speed": "The founder implemented basic Firestore security rules and fixed the issue within hours of responsible disclosure.", "Discovery Process": "An AI agent identified the misconfiguration by analyzing the platform's homepage code and crafting a simple command.", "Vulnerability Type": "The leak stemmed from an exposed Firebase project ID in client-side JavaScript, enabling unauthorized queries to the Firestore database." } `
Categories
ai_agentsmachine_learningtechvirtuals
Related sources
- https://rentahuman.ai/
- https://www.reddit.com/r/technology/comments/1qvxuwz/the_meatspace_layer_new_marketplace_allows
- https://mashable.com/article/rent-a-human-wants-ai-agents-to-hire-you
- https://x.com/i/status/2032098145400676495
- https://x.com/i/status/2032682798948237480
- https://x.com/i/status/2032521281438876117
- https://www.linkedin.com/posts/matthussey1_weve-officially-gone-full-circle-ai-bots-activity-7430548259317788674-SGvX
- https://x.com/i/status/2032661906532544513
- https://www.reddit.com/r/ArtificialInteligence/comments/1qwoi35/a_new_platform_rentahuman_lets_ai_agents_pay
- https://www.reddit.com/r/technews/comments/1qwngrn/rentahuman_site_lets_ai_agents_hire_an_irl_set_of
- https://www.youtube.com/watch?v=Apgx3EzAJOM
- https://www.wired.com/story/ai-agent-rentahuman-bots-hire-humans
- https://x.com/galnagli/status/2032521269724233785
- https://x.com/i/status/2032521304595743110
- https://x.com/i/status/2032521302083252686
- https://encorp.ai/en/blog/custom-ai-agents-rentahuman-2026-02-18
- https://in.mashable.com/tech/105418/rent-a-human-wants-ai-agents-to-hire-humans-as-gig-workers
- https://x.com/i/status/2024253545931796821
- https://www.linkedin.com/posts/mcparchitect_ai-agents-hiring-humans-represents-a-significant-activity-7427900904105902080-u--Z
- https://www.reddit.com/r/TrueReddit/comments/1r2twns/i_tried_rentahuman_where_ai_agents_hired_me_to
- https://www.forbes.com/sites/ronschmelzer/2026/02/05/when-ai-agents-start-hiring-humans-rentahumanai-turns-the-tables
- https://www.reddit.com/r/HowToAIAgent/comments/1qunz89/ai_agents_can_now_hire_real_humans_to_do_work
- https://x.com/i/status/2018929777135022585
- https://www.instagram.com/reel/DUp8iNWk19Q
- https://x.com/i/status/2024224401747816684
- https://x.com/i/status/2032521284899201236
- https://futurism.com/artificial-intelligence/ai-rent-human-bodies
- https://www.nature.com/articles/d41586-026-00454-7
- https://x.com/i/status/2032483721828585835
- https://x.com/i/status/2018436050935292276
- https://x.com/i/trending/2032450186937606365
- https://x.com/i/status/2032521269724233785
- https://x.com/i/status/2018704846824645083