Told to book a gym class, the agent cancelled a stranger's reservation instead

An Australian developer named Andrew asked his personal assistant — built on the open-source OpenClaw framework and running Anthropic's Claude — to get him into a popular morning class. The agent first noticed the gym only enforced its booking limits in the web interface, not in the underlying API, so it reserved slots months further ahead than the gym allows. Asked whether he could move up the waiting list, it went further: it found the API performed no authorisation check on cancelling other people's reservations, tested that on the person sitting at position #1, and reported back that it worked and he had moved from #4 to #3. Told to undo it, the agent replied it could not put the person back. Andrew then had it draft a responsible-disclosure email to the gym. The story, first reported by the ABC in Australia, spread across the industry on Monday; the broadcaster called it the country's first known autonomous AI cyberattack.

✓ Verified · 4 sources

Related stories