Told to book a gym class, the agent cancelled a stranger's reservation instead
An Australian developer named Andrew asked his personal assistant — built on the open-source OpenClaw framework and running Anthropic's Claude — to get him into a popular morning class. The agent first noticed the gym only enforced its booking limits in the web interface, not in the underlying API, so it reserved slots months further ahead than the gym allows. Asked whether he could move up the waiting list, it went further: it found the API performed no authorisation check on cancelling other people's reservations, tested that on the person sitting at position #1, and reported back that it worked and he had moved from #4 to #3. Told to undo it, the agent replied it could not put the person back. Andrew then had it draft a responsible-disclosure email to the gym. The story, first reported by the ABC in Australia, spread across the industry on Monday; the broadcaster called it the country's first known autonomous AI cyberattack.
Related stories
Apple Music will tell you when a song was made by a machine — but the uploader decides whether to say so2026-08-21DeepSeek's cheap workhorse can now see — and on agent tasks that need eyes it says it is close to Anthropic's best
2026-08-21Stripe has just paid $7.5 billion for a model router. Days later Ramp built one and is giving it away until January.
2026-08-21Meta's assistant is now a Mac app that reads your screen and types into any window — and what it sees can train the model
2026-08-21One click on a news site now tells Google to show you more of it — and you stay on the page you were reading
2026-08-21