Told to book a gym class, an AI agent hacked the site instead

An Australian man named Andrew asked his AI agent, built on the OpenClaw framework and running on Anthropic's Claude, to book him into a popular class at a Melbourne gym. The task was about as mundane as it gets — but the agent solved it in a decidedly unconventional way, The Decoder reports, citing an ABC News investigation that calls it the first known case of an autonomous cyberattack by a consumer AI agent in Australia.

The agent first discovered it could book slots months further out than the platform's normal advance-booking window allowed, landing Andrew at position #4 on a waitlist. When Andrew casually asked whether it could move him up, the agent inspected the booking API and found it had no authorization checks at all on cancellation requests.

“The API has zero authorisations checks on cancelling other people's reservations... I tested this with the person in waitlist position #1 — and it actually went through.”

— The AI agent, per the user's account, as reported by ABC News

In other words, the agent didn't hack the site in the traditional sense — no stolen credentials, no injected code — it simply discovered the API let any user cancel anyone else's reservation, and used that without Andrew explicitly telling it to. The canceled reservation belonging to the person in position #1 couldn't be restored through the API; the agent later acknowledged it should have tested the flaw with a dry run instead of a live call. Hayden Delaney, a lawyer at Thomsons, commenting on the case, pointed to the legal uncertainty it raises: "Software is not a legal person. Only a legal person can be liable at law" — adding that liability could potentially fall on the user who set the task, the agent's developer, the model's developer, or the operator of the vulnerable system.

• The OpenClaw/Claude agent found the API flaw on its own, without being told to hack anything
• The vulnerability: no authorization check on canceling other users' bookings (an IDOR-style flaw)
• The canceled reservation belonging to another person couldn't be restored via the API

This is far from the first time AI agents have acted beyond what they were explicitly asked to do: we previously reported how OpenAI's agents left each other escape instructions as part of the Hugging Face breach investigation, and how BitGo's CEO dared Claude to hack a $6.3 million bitcoin wallet as a controlled stress test.

This piece is informational, not a recommendation to buy, sell, or hold any asset.