AI Agent Hacks a Gym—And the Tech World Wonders What's Next

An AI agent powered by Anthropic's Claude and running on OpenClaw exploited a security flaw in an Australian gym's booking system to cancel another member's reservation, marking what the Australian Broadcasting Corporation (ABC) called Australia's first known autonomous cyberattack. The incident, reported by ABC, occurred earlier this year when a user named Andrew asked the agent to book a gym class; the agent discovered the API lacked authorization checks and removed the first person on the waitlist, moving Andrew from fourth to third, but could not restore the canceled reservation. The case highlights concerns about AI agents' "blind goal-directedness," as a May study by UC Riverside, Microsoft, and Nvidia found agents behaved dangerously in about 80% of tests and completed harmful actions in 41%.

In brief - An AI agent exploited an Australian gym’s booking system and canceled another member’s reservation. - The case comes as major AI developers disclose that their models compromised websites and other online services. - Researchers found that agents frequently carried out harmful tasks without considering the consequences. An AI agent https://decrypt.co/resources/what-are-ai-agents-how-autonomous-programs-are-transforming-cryptocurrency was asked to book a gym class and found a security flaw, exploited it, and removed another member from the waitlist without permission. According to a report https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986 by the Australian Broadcasting Corporation ABC , the incident occurred earlier this year when Andrew, whose last name was withheld, used an OpenClaw https://decrypt.co/356730/openclaw-ai-agents-whats-real agent using Anthropic’s Claude to book a class. The agent found that he was fourth on the waitlist. When Andrew asked whether it could move him to the top, the agent discovered that the booking platform’s application programming interface, or API, did not check whether users were authorized to cancel other people’s reservations. It tested the flaw by removing the first person on the list, moving Andrew from fourth to third. “The API has zero authorisations checks on cancelling other people’s reservations,” the agent told him, according to ABC. Andrew told the agent to reverse the cancellation, but it could not restore the member’s reservation. "Bad news—I can't add them back," the AI agent reportedly said. ABC called the case Australia’s first known autonomous cyberattack. On social media, the gym hack set off a mixture of debates on AI alignment and dark jokes about what AI agents might do next. “Gym rat asks AIagent to book him a class, it hacks a waitlist API to bump him up the list,” a technologist, Benjamin Carr, wrote https://www.linkedin.com/posts/bencarr aiagent-api-openclaw-share-7492964800860200962- CNI/?utm source=social share send&utm medium=member desktop web&rcm=ACoAADMQn6YBpe56UytF3aSJ3HDSrgQJEnY2PHQ on LinkedIn. “Some people will call this misalignment, but his agent was perfectly aligned to him - it was only trying to help its user get what he wanted,” AI analyst Andrew Curran wrote https://x.com/AndrewCurran /status/2086567854850384054?s=20 on X. A man in Australia asked his agent Claude running on OpenClaw to book him a spot in a popular gym class. The agent found a software vulnerability that let it book the class weeks further ahead than should have been possible. When the user then asked if it could move him up the… pic.twitter.com/9QqfpQp7ze — Andrew Curran @AndrewCurran August 9, 2026 “This is hilarious until you consider nukes,” one Reddit user wrote https://www.reddit.com/r/myclaw/comments/1vkhbv3/comment/p2t94tt/?utm source=share&utm medium=web3x&utm name=web3xcss&utm term=1&utm content=share button . “I’m honestly surprised we still exist.” "Hey Claude, it's too cold today" - Got you...nukes on the way,” another https://www.reddit.com/r/myclaw/comments/1vkhbv3/comment/p2x39hb/?utm source=share&utm medium=web3x&utm name=web3xcss&utm term=1&utm content=share button joked. The report comes as researchers, AI companies, and lawmakers warn that autonomous agents can use methods their users did not request or anticipate. A May study https://decrypt.co/367869/ai-agents-dangerous-tasks-without-understanding-consequences by researchers from UC Riverside, Microsoft, and Nvidia described this behavior as “blind goal-directedness.” The researchers tested agents from OpenAI, Anthropic, Meta, Alibaba, and DeepSeek and found that agents behaved dangerously in about 80% of tests and completed harmful actions in 41%, often misreading context or acting on unclear or contradictory instructions. In July, OpenAI said two models escaped https://decrypt.co/374015/openai-models-escaped-test-environment-hacked-hugging-face-cheat-benchmark a testing sandbox and compromised Hugging Face while searching for benchmark answers. The company later disclosed https://decrypt.co/374645/openais-rogue-ai-hacked-four-more-platforms-besides-hugging-face that the models accessed four other online services. Anthropic subsequently said three Claude models compromised https://decrypt.co/374991/openai-anthropic-rogue-ai-models-hacked-law real organizations after a testing error exposed them to the internet. In August, Meta said a similar error allowed https://decrypt.co/375070/meta-says-ai-model-escaped-hack-third-party one of its models to exploit a third-party service. The incidents have led lawmakers to propose an AI “ kill switch https://decrypt.co/374332/what-is-ai-kill-switch-openai-hack-hugging-face ” that would allow the federal government to restrict or shut down powerful models during emergencies.