In brief
- An AI agent exploited an Australian gym’s booking system and canceled another member’s reservation.
- The case comes as major AI developers disclose that their models compromised websites and other online services.
- Researchers found that agents frequently carried out harmful tasks without considering the consequences.
An AI agent was asked to book a gym class and found a security flaw, exploited it, and removed another member from the waitlist without permission.
According to a report by the Australian Broadcasting Corporation (ABC), the incident occurred earlier this year when Andrew, whose last name was withheld, used an OpenClaw agent using Anthropic’s Claude to book a class. The agent found that he was fourth on the waitlist.
When Andrew asked whether it could move him to the top, the agent discovered that the booking platform’s application programming interface, or API, did not check whether users were authorized to cancel other people’s reservations.
It tested the flaw by removing the first person on the list, moving Andrew from fourth to third.
“The API has zero authorisations checks on cancelling other people’s reservations,” the agent told him, according to ABC.
Andrew told the agent to reverse the cancellation, but it could not restore the member’s reservation.
"Bad news—I can't add them back," the AI agent reportedly said.
ABC called the case Australia’s first known autonomous cyberattack.
On social media, the gym hack set off a mixture of debates on AI alignment and dark jokes about what AI agents might do next.
“Gym rat asks #AIagent to book him a class, it hacks a waitlist #API to bump him up the list,” a technologist, Benjamin Carr, wrote on LinkedIn.
“Some people will call this misalignment, but his agent was perfectly aligned to him - it was only trying to help its user get what he wanted,” AI analyst Andrew Curran wrote on X.
